Moonwell

[L-01] MERC20DelegateMadFixer.sol:SweepAll Sweeping 3 Different Tokens Without Specifying Decimals: Not Best Practice.

Description:

Referencing the documentation at https://docs.nomad.xyz/token-bridge/deployed-tokens/mainnet, we find that the following tokens have varying decimal precision:

Wrapped BTC: 8 decimals
Wrapped Ether: 18 decimals
USDC: 6 decimals

When using the balanceOf function, the returned balance of an address doesn't include any specification of decimals. However, it's important to note that the balances being swept, such as nomadusdc, nomadbtc, and nomadeth, all possess different decimal precision."

Impact

This will not have any impact in this case, but if the decimal position is never considered it can lead to potential errors and unexpected behavior.

Rather have it as best practice to ensure no problems will arrive from this now or in the near future.

Proof of Concept:

The balanceOf function retrieves the balance of a token without considering its decimal precision. Therefore, it's best practice to ascertain the decimal precision of each token before transferring them. This approach ensures smooth transactions, especially when dealing with multiple tokens, each having different decimal precisions, within a single contract.

Recommended Mitigation:

Old code

New suggested code.

Tools used