Submission Details
Severity:
overflow when token's decimals > 18
Vulnerability Details
From contest details, it is assumed that protocol work with token that have any decimals.
function descaleAmount(uint256 amount, uint8 decimals) internal pure returns (uint256) {
if (decimals == 18) {
return amount;
}
unchecked {
uint256 scaleFactor = 10 ** (18 - decimals); // <---
return amount / scaleFactor;
}
}
function scaleAmount(uint256 amount, uint8 decimals) internal pure returns (uint256) {
if (decimals == 18) {
return amount;
}
unchecked {
uint256 scaleFactor = 10 ** (18 - decimals); // <---
return amount * scaleFactor;
}
}
But both descaleAmount()and **scaleAmount()**function assumed that all token will have decimals smaller than 18. When token's decimals > 18, it will make it become underflow, lead to unexpected result for protocol.
Impact
unexpected result for protocol due to underflow
Tools Used
Manual review
Recommendations
Handle when decimals > 18 and < 18 separately
Updates
Lead Judging Commences
inallhonesty
11 months ago
inallhonesty 10 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
[Invalid] Tokens with decimals > 18
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
69929 USDC / LOC
19,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.