The Standard

Summary

Assets distribution works correctly only for ERC20 tokens having decimals <= 18.

Vulnerability Details

In the function distributeAssets(), calculation of costInEuros is performed only considering ERC20 tokens having decimal <= 18

uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd)
* _hundredPC / _collateralRate;

Some of the known ERC20 tokens which have > 18 decimals (example YAMv2 having 24 decimals precision) if used will not work with current implementation.

Impact

If assets having tokens decimals > 18 allowed then that will cause overflow error.

Tools Used

Manual

Recommendations

apply check for length of decimal precision
uint256 costInEuros = 18 >=
asset.token.dec
? (_portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) * _hundredPC) / uint256(priceEurUsd)
/ _collateralRate;
: (_portion * uint256(assetPriceUsd) * _hundredPC) / 10 ** (asset.token.dec - 18) / uint256(priceEurUsd)
/ _collateralRate;