The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Protocol plans on supporting more tokens but hardcodes 18 decimals as maximum for assets which would cause issues

bauchibred

Proof of Concept

Take a look at this section from distributeAssets()

uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd)
* _hundredPC / _collateralRate;

Note that distributeAssets() is one of the core fucntions present in the protocol, now based on discussion that's been had in the discord chat, protocol plans on accepting more tokens, the issue with this is that some tokens have more than 18 decimals, which would lead to a reversion on an attemot to distribute assets due to an underflow.

Impact

Low, since this depends on an attempt to add these tokens in the future, but currently if such tokens are added as accepted then an attempt to distributeAsset() would always revert

Recommended Mitigation Steps

Reimplement the logic and try supporting assets with more than 18 decimals

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.