Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Assuming decimals of auction token is 18 is risky

gajiknownnothing

Summary

The FjordAuction::auctionEnd() function assumes that the auction tokens have 18 decimals. This assumption is risky because many tokens, such as USDC, have different decimals.

Vulnerability Details

The multiplier for claimable tokens is calculated using the following formula:

File: FjordAuction.sol
181: function auctionEnd() external {
...
197: multiplier = totalTokens.mul(PRECISION_18).div(totalBids);

Here, decimals of bid point is 18. However, this formula implicitly assumes that the auction tokens also have 18 decimals. If the auction token has a different number of decimals, such as 6 for USDC, this assumption can lead to incorrect calculations.

Impact

Unexpect rounding down causes loss of assets.

For example, given:

  • totalTokens of USDC is 100e6

  • totalBids of point is 1000000000e18

multiplier = 100e6 * 1e18 / 1000000000e18 = 0, resulting in claimable auction tokens being zero.

Tools Used

vscode

Recommendations

Normalize the decimals of the auction token to 18 before performing further calculations.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Low decimal tokens or super small bids can lead to 0 claims

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.