LiquidationPool::distributeAssets assumes the token decimals to be less than 18
Summary
LiquidationPool assumes the decimals for ERC20 tokens to be max of 18 places. But this is not always true.
So, incase a new token with more than 18 decimals is added, it will create a conflict in the processing of asset distribution.
Vulnerability Details
The protocol will not work with tokens that have decimal places greater than 18
Impact
The transaction will revert leading to failure for tokens with decimals greater than 18 places. This could potentially block the distributeAsset functionality in the contract.
Tools Used
Manual Review
Recommendations
Add checks at the time of onboarding new ERC20 tokens to only onboard tokens that have decimals less than 18 places. If that check is implemented, the risk related to computation at the time of distribution of tokens can be avoided.
Lead Judging Commences
informational/invalid
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.