Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Decimal Mismatch in Auction::buy() Function leads to overpaying

josh4324

Summary

The buy() function allows users to purchase ZENO tokens using USDC. However, the function does not account for the difference in decimal precision between ZENO (18 decimals) and USDC (6 decimals).

This leads to incorrect cost calculations, causing users to overpay when purchasing ZENO tokens.

Vulnerability Details

function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
uint256 cost = price * amount; // ❌ Incorrect calculation due to decimal mismatch
require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");
​
bidAmounts[msg.sender] += amount;
state.totalRemaining -= amount;
state.lastBidTime = block.timestamp;
state.lastBidder = msg.sender;
​
zeno.mint(msg.sender, amount);
emit ZENOPurchased(msg.sender, amount, price);
}
​

ZENO uses 18 decimals, meaning 1 ZENO = 10^18 wei.

USDC uses 6 decimals, meaning 1 USDC = 10^6 wei.

The function calculates cost = price * amount without adjusting for decimal differences.

This results in incorrect payment amounts, leading to users being charged too much.

Impact

Users will pay 10^12 times more than expected due to decimal mismatch.

Tools Used

Manual Review

Recommendations

Adjust Cost Calculation for Decimal Mismatch

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Auction.sol's buy() function multiplies ZENO amount (18 decimals) by price (6 decimals) without normalization, causing users to pay 1 trillion times the intended USDC amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.