Disturbed pegging of CrimeMoney with USDC due to decimals difference between both tokens.
Summary
The default decimals of ERC20 contract is 18 and so are the decimals in CrimeMoney token contract but the USDC token has decimal of 6 on Polygon chain.
USDC Link on Polygonscan: https://polygonscan.com/token/0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359
As the protocol is to be deployed on Polygon chain thus CrimeMoney will not be pegged to USDC due to difference in the decimals.
Vulnerability Details
The vulnerability is present in the CrimeMoney contract where it has a 18 decimal and is considered to be pegged with USDC but as USDC on Polygon has 6 decimals, therefore the peg will not be maintained due to decimal difference.
When a user deposits 1 USDC on the MoneyShelf they will only get 0.000000000001 CrimeMoney token, and thus CrimeMoney is not pegged to USDC.
Impact
CrimeMoney is not pegged to USDC.
Tools Used
Manual Review
Recommendations
Consider changing the decimals of CrimeMoney to 6.
Lead Judging Commences
USDC decimals not handled
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.