Part 2

Summary

In Vault there is a function getTotalCreditCapacityUsd used to fetch the vault's total credit capacity allocated to the connected markets. However, currently it doesn't support low decimal tokens.

Vulnerability Details

In Vault there is a function getTotalCreditCapacityUsd used to fetch the vault's total credit capacity allocated to the connected markets. However, currently it doesn't support low decimal tokens.

Let's take a look at this line:

If our indexToken has decimals less than 18 then the whole calculation will be wrong.

Let's have the following scenario:

1. indexToken has 6 decimals.

2. The total assets are 10 tokens.

3. totalAssetsX18 will be 10e6.

4. The function will return the value in 6 decimals and not the desired 18.

Impact

Wrong credit capacity calculation will lead to wrong checks performed in VaultRouterBranch::redeem which in itself will lead to the check for unlocked credit capacity not working.

Tools Used

Manual Review

Recommendations

Convert the IERC4626(vault.indexToken).totalAssets() first to an 18 decimal value before performing the calculation to ensure that all indexTokens with decimals less than or equal to 18 will work correctly.