crimeMoney not pegged to USDC
Summary
value deposited/withdrawn different from that minted/burnt because USDC has only 6 decimals and crimeMoney has 18
Vulnerability Details
crimeMoney is overcollateralized: the amount of usdc provided to keep that peg is much more than it should be (1018/106 = 10**12)
Impact
Not in sync with the documentation, as it wwas stated that crimeMoney is pegged to USDC but it is not; If any user deposits 1,000,000,000$ worth of USDC, they're getting 1000/(10**12) so 0.001$ worth of crimeMoney
Tools Used
Manual review
Recommendations
Fix the bug
the amount of crimeMoney minted during the deposit should be multiplied by 10**12
the amount of crimeMoney burnt during the deposit should be divided by 10**12
Lead Judging Commences
USDC decimals not handled
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.