Submission Details
Severity:
In `makeMerkle.js`, the amount is incorrect and USDC Token decimal places is 6 not 18 which cause wrong generation of Merkle Root.
Summary
In
makeMerkle.js, the amount is incorrect and USDC Token decimal places is 6 not 18 which cause wrong generation of Merkle Root.
Vulnerability Details
this amount is incorrect because USDC Token decimal places is 6 not 18. which we can verify from here
this will generate incorrect Merkle Root.
@> const amount = (25 * 1e18).toString()
const userToGetProofOf = "0x20F41376c713072937eb02Be70ee1eD0D639966C"
POC
Here we can see that decimal places of USDC Token is 6 not 18.
Impact
Incorrect generation of Merkle Root
USDC Token decimal places is 6 not 18 which will cause the amount to be incorrect.
Tools Used
Manual Review
Recommendations
put this in
makeMekle.jsto generate the root.decimal places of USDC Token is 6 not 18.
- const amount = (25 * 1e18).toString()
+ const amount = (25 * 1e6).toString()
const userToGetProofOf = "0x20F41376c713072937eb02Be70ee1eD0D639966C"
Updates
Lead Judging Commences
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
wrong-usdc-decimals-in-merkle
Rewards breakdown
nSLOC
62This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.