Tadle

Vulnerability Details

Protocol dangerously assumes all ERC-20 tokens have 18 decimals which isn't always the case. For example:

• USDC and USDT have 6 decimals, means 1 unit of these tokens in my wallet or in the CapitalPool will worth $0.000001

• YAMv2 has 24 decimals, means 1 unit of YAMv2 token in my wallet or in the CapitalPool will worth $0.000000000000000000000001 (if the price per token was 1$)

Impact

This mis-calculation leads to transferring much more/less amounts from/into the protocol than intended and causes loss of funds for users or the protocol.

Tools Used

• Manual review

Recommendations

• Use white list to allow interacting just with the tokens that have exactly 18 decimals.

• Take consideration for different decimals of different tokens when calculating.