Part 2

Description

The function does not account for differences in token decimals (e.g., wstEth with 18 decimals vs. usdc with 6 decimals), leading to precision loss.

Summary

Incorrect conversions between token amounts and USD values could result in incorrect withdrawal amounts.

Vulnerability Details

• Issue: The function does not properly handle token decimals, leading to precision loss.

• Example: Withdrawing 1e18 units of wstEth (1 token) vs. 1e6 units of usdc (1 token) could result in incorrect USD calculations.

Impact

• Precision loss could lead to incorrect withdrawal amounts, disadvantaging users.

Tools Used

• Manual Code Review

• Foundry/Forge

Recommendations

• Ensure proper conversion between token amounts and USD values, accounting for token decimals.

function convertTokenAmountToUd60x18(address token, uint256 amount) internal view returns (UD60x18) {

uint256 decimals = IERC20Metadata(token).decimals();

return ud60x18(amount * 1e18 / (10 ** decimals));