Submission Details
Severity:
Protocol does not account for USDC 6 decimals
Summary
Protocol does not account for tokens not 18 decimals e.g USDC 6 decimals
Vulnerability Details
uint256 public constant EXCHANGE_RATE_PRECISION = 1e18; //AssetToken.sol
uint256 mintAmount = (amount * assetToken.EXCHANGE_RATE_PRECISION()) / exchangeRate; // Thunderloan.sol
uint256 amountUnderlying = (amountOfAssetToken * exchangeRate) / assetToken.EXCHANGE_RATE_PRECISION();
AssetToken uses exchange rate precision sutied for 18 decimal tokens which may not be ideal for other tokens. In calculating mintAmount or redemption underlying amounts for example in above protocol does not take into account differences in decimals for other tokens e.g USDC.
Impact
Results in large precision losses that will impact the amounts minted and redemption amounts to be incorrect for the respective transaction
Tools Used
Manual Analysis
Recommendations
Rewards breakdown
nSLOC
387This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.