Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Decimal Handling in `ZENO::redeem/redeemAll` Causes Catastrophic Funds Drainage

zgczgc

Summary

The ZENO::redeem and ZENO::redeemAll functions fail to account for the decimal precision mismatch between ZENO (18 decimals) and USDC (6 decimals). This discrepancy creates a 1e12 magnitude error in asset transfers. For example:

  • When a user holds 1 ZENO token (1e18 units) and calls redeemAll, the contract erroneously transfers 1e18 USDC units instead of the correct 1e6 units.

  • This represents a 1,000,000x overpayment per redemption transaction.

Vulnerability Details

function redeem(uint amount) external nonReentrant {
if (!isRedeemable()) {
revert BondNotRedeemable();
}
if (amount == 0) {
revert ZeroAmount();
}
uint256 totalAmount = balanceOf(msg.sender);
if (amount > totalAmount) {
revert InsufficientBalance();
}
totalZENORedeemed += amount;
_burn(msg.sender, amount);
USDC.safeTransfer(msg.sender, amount); <==@found
}
​
function redeemAll() external nonReentrant {
if (!isRedeemable()) {
revert BondNotRedeemable();
}
uint256 amount = balanceOf(msg.sender);
totalZENORedeemed += amount;
_burn(msg.sender, amount);
USDC.safeTransfer(msg.sender, amount); <==@found
}

Impact

Complete drainage of USDC reserves within 1-2 transactions

Tools Used

  • Manual Review

Recommendations

  • Add precision conversion.

Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Decimal precision mismatch between ZENO token (18 decimals) and USDC (6 decimals) not accounted for in redemption, causing calculation errors and incorrect payments

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!