First Flight #14: AirDropper
First Flight #14
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Decimals of USDC may change, affecting the number of tokens send to the contract on deployment

wetzo

Summary

The 6 decimals of USDC is hardcoded in Deploy.s.sol, but USDC is a proxy contract and it's implementation could potentially change. If decimals changes from 6 to another number, the amount of USDC sent to the contract would no longer match the expected amount, making it higher or lower.

Vulnerability Details

A proxy contract can change it's implementation at any moment and it is dangerous to assume that its properties will always stay the same.

Impact

Assuming that the USDC contract decimals change and all user balances are updated accordingly, that is, if decimals are now 2, a user previously holding 1_000_000 now holds 100, the deployment may send 1,000 times too much USDC. Or, at the opposite, if decimals are now 18, it will only send a fraction of the amount.

Tools Used

Manual review

Recommendations

Call USDC contract to get the current decimal numbers at contract deployment.

- uint256 public s_amountToAirdrop = 4 * (25 * 1e6);
+ uint256 public s_amountToAirdrop = 4 * (25 * IERC20Metadata(s_zkSyncUSDC).decimals());

PS: the MerkleRoot will also be affected as it holds the amount that a user can claim.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.