Core Contracts

Summary

The calculateRcrvUSDAmount function incorrectly computes the scaling factor when converting between deCRVUSD and rCRVUSD.

Vulnerability Details

The scaling factor is calculated as:

This formula incorrectly applies the decimal adjustment, leading to incorrect conversion values. The correct formula should be:

This ensures that deCRVUSD is correctly scaled down or up to match rCRVUSD's decimal precision.

Example Scenario

Assume:

• deTokenDecimals = 6

• rTokenDecimals = 18

• deCRVUSDAmount = 1,000,000

• getExchangeRate() = 2

With the incorrect formula:

Thus, the incorrect formula may result in zero or massively inflated values, depending on the token pair.

Impact

• Users may receive incorrect rCRVUSD amounts upon withdrawal, leading to financial losses.

• If the result is rounded to zero, withdrawals will fail for small amounts.

• If the result is too high, it could drain the contract’s rCRVUSD balance.

Tools Used

Manual review

Recommendations

• Update the formula to:

  uint256 scalingFactor = 10**(18 + deTokenDecimals - rTokenDecimals);