The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Tokens with more than 18 decimals will result in complete DOS of the protocol

Mlome

Summary

Some ERC20 tokens have more than 18 decimals (e.g. YAM-V2 has 24). If such token is an accepted token, some opperations will underflow. The built-in underflow check of Solidity (version > 0.8.0) will revert the transaction, resulting in complete DOS of the protocol.

Vulnerability Details

The LiquidationPool::distributeAssets() function uses the token decimals to compute the rewards:

LiquidationPool.sol#L220

File: LiquidationPool.sol
​
L220: uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd)
* _hundredPC / _collateralRate; //@audit 18 - asset.token.dec can underflow

If the asset.token.dec is more than 18 it will underflow and the transaction will revert, blocking the liquidation process.

The number of decimals is also used in the PriceCalculator contract (out of scope) which is used to compute the collateral amount of the vaults.

File: utils/PriceCalculator.sol
​
L39: function getTokenScaleDiff(bytes32 _symbol, address _tokenAddress) private view returns (uint256 scaleDiff) {
return _symbol == NATIVE ? 0 : 18 - ERC20(_tokenAddress).decimals(); // @audit underflow if decimals > 18
}

A number of decimals > 18 will block all the vaults operations.

Impact

If a token with more than 18 decimals becomes an accepted token, it will lead to a complete DOS of the protocol.

Tools Used

Manual review

Recommendations

Check that token.decimals() <= 18 before adding a new accepted token.

Updates

Lead Judging Commences

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Mlome Submitter
almost 2 years ago
hrishibhat Lead Judge
almost 2 years ago
hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.