Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Decimal Mismatch in ZENO::redeem() and ZENO::redeemAll() leads to users receiving more usdc tokens

josh4324

Summary

The redeem() and redeemAll() functions allow users to exchange ZENO tokens (18 decimals) for USDC (6 decimals). However, these functions do not properly convert ZENO’s 18 decimal format into USDC’s 6 decimal format before transferring USDC to users.

This results in users receiving 10^12 times more USDC than intended.

Vulnerability Details

function redeem(uint amount) external nonReentrant {
if (!isRedeemable()) {
revert BondNotRedeemable();
}
​
if (amount == 0) {
revert ZeroAmount();
}
​
uint256 totalAmount = balanceOf(msg.sender);
if (amount > totalAmount) {
revert InsufficientBalance();
}
​
totalZENORedeemed += amount;
_burn(msg.sender, amount);
USDC.safeTransfer(msg.sender, amount); // ❌ Incorrect decimal conversion
}
​
function redeemAll() external nonReentrant {
if (!isRedeemable()) {
revert BondNotRedeemable();
}
​
uint256 amount = balanceOf(msg.sender);
totalZENORedeemed += amount;
_burn(msg.sender, amount);
USDC.safeTransfer(msg.sender, amount); // ❌ Incorrect decimal conversion
}
​

ZENO uses 18 decimals, meaning 1 ZENO = 10^18 wei.

USDC uses 6 decimals, meaning 1 USDC = 10^6 wei.

The function transfers amount of USDC directly without adjusting for decimal differences.

Users will receive 10^12 times more USDC than intended.

This results in catastrophic financial loss for the protocol.

Impact

Users receive 1,000,000,000,000x more USDC than expected per ZENO redeemed.

Tools Used

Manual Review

Recommendations

Convert ZENO amount from 18 decimals to 6 decimals before transfer.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Decimal precision mismatch between ZENO token (18 decimals) and USDC (6 decimals) not accounted for in redemption, causing calculation errors and incorrect payments

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.