Submission Details
Severity:
Precision loss in `Auction.sol::buy()` function, on zuno mint.
Summary
Contract - Auction.sol
The buy function is as follow -
function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
uint256 cost = price * amount;
require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");
bidAmounts[msg.sender] += amount;
state.totalRemaining -= amount;
state.lastBidTime = block.timestamp;
state.lastBidder = msg.sender;
@-> zeno.mint(msg.sender, amount);
emit ZENOPurchased(msg.sender, amount, price);
}
getPrice()
function getPrice() public view returns (uint256) {
if (block.timestamp < state.startTime) return state.startingPrice;
if (block.timestamp >= state.endTime) return state.reservePrice;
return state.startingPrice - (
(state.startingPrice - state.reservePrice) *
(block.timestamp - state.startTime) /
(state.endTime - state.startTime)
);
}
The zuno decimal will be 18 by default (as ERC20 decimal function isn't overridden). It means zeno amount being minted to buyer should be in 18 decimal precision, it's not done is getPrice() as well.
Vulnerability Details
User is getting the zuno amount with USDC 8 decimals, but he should be given in 18 decimals.
As the mint amount is not scaled to 18 decimals, user will get very-very less zuno amount.
Impact
Loss of fund to user
Tools Used
Manual
Recommendations
Scale to 18 decimals, before minting zuno amount to user.
Updates
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.