Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Auction.sol::buy() does not account for decimals, making users unable to buy, or buy at a very high price.

wickie

Summary

The buy() in Auction.sol, lets users buy ZENO tokens while price decreases as the auction comes to an end. It calculates the price based on how much the auction has passed, using getPrice(). This price is then multiplied by the amount of ZENO tokens users want to buy, and the result is transferred from the user. Since the function does not take account if decimals, this makes the function reverts when users dont have enough USDC or takes a lot more USDC.

Vulnerability Details

In buy()

function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
uint256 cost = price * amount;
require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");

Since the price is in terms of USDC and ZENO has 18 decimals (default ERC20 value), at a price of 1 USDC, just for 1 ZENO, the users will pay 1e18 USDC.

Impact

The function is mostly unusable because of the require statement, and users will need to pay a lot more for it to pass and buy ZENO.

Tools Used

Manual Review

Recommendations

Account for decimals before transfer.

function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
-- uint256 cost = (price * amount);
++ uint256 cost = (price * amount) / zeno.decimals;
require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");
Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Auction.sol's buy() function multiplies ZENO amount (18 decimals) by price (6 decimals) without normalization, causing users to pay 1 trillion times the intended USDC amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.