The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

`asset.token.dec` could be greater than 18 causing `distributeAssets()` function to revert due to underflow

dopeflamingo

Summary

If one of the assets in the protocol has a decimals value that is greater than 18, the distributeAssets function in LiquidationPool will revert.

Vulnerability Details

In LiquidationPool::distributeAssets(), the costInEuros is calculated like this

uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd) * _hundredPC / _collateralRate;

(18 - asset.token.dec) can therefore underflow when asset.token.dec is greater than 18.

Impact

As the protocol wishes to extend the capabilities to account for a lot more tokens on a variety of different chains in the future. If this function underflows, this means the assets won't be distributed into the liquidation pool ready for users to claim their rewards. This essentially means depositing a token that has a decimal greater than 18 will stop all assets from being distributed.

Tools Used

Manual Review

Recommendations

Add a require statement to check for the decimals to be greater than 18.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.