Decimal Precision Loss in Auction Price Calculation
Summary
The Auction contract's buy function performs price calculations without accounting for decimal differences between ZENO (18 decimals) and USDC (6 decimals), leading to incorrect cost calculations and potential loss of funds.
Vulnerability Details
In the buy function, the cost calculation is performed without decimal handling:
uint256 cost = price * amount;
Example:
Buying 1.0 ZENO at 2 USDC price:
amount = 1e18 (1 ZENO)
price = 2e6 (2 USDC)
Current: cost = 2e6 * 1e18 - (overpriced)
Expected: cost = 2e6 (2 USDC)
Impact
Incorrect cost calculations leading to:
Failed transactions due to massive USDC amounts
If transaction succeeds, severe overcharging of users
Tools Used
Manual Review
Recommendations
Adjust the price calculation to account for the decimal difference between ZENO (18) and USDC (6)
Lead Judging Commences
Auction.sol's buy() function multiplies ZENO amount (18 decimals) by price (6 decimals) without normalization, causing users to pay 1 trillion times the intended USDC amount
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.