Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect calculation in the `Auction::buy` function leads to an inaccurate cost determination.

saurabh_singh

Summary

The Auction::buy function calculates the cost incorrectly.

Vulnerability Details

The calculation for cost in the buy function does not include decimal precision, leading to an incorrect cost calculation.

the getPrice()function will return price of zeno ( which will let say follows 6 or 8 decimals).

since the zeno are ERC20 tokens they follows 18 decimals.

the cost = price * amount;

= price in 8 decimals * amount in 18 decimlas

Now the usdc follows 6 decimals , The cost calculated will be way greater than intended, hence user will send more used than needed.

function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
@>> uint256 price = getPrice();
@>> uint256 cost = price * amount;
@>> require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");
​
bidAmounts[msg.sender] += amount;
state.totalRemaining -= amount;
state.lastBidTime = block.timestamp;
state.lastBidder = msg.sender;
​
zeno.mint(msg.sender, amount);
emit ZENOPurchased(msg.sender, amount, price);
}

Proof of Code

Lets take an example for that :-

amount = 2500e18
price = 50e8 // if it has 8 decimals
​
cost = 2500e18 * 50e8
=125000e26
the usdc follows 6 decimals
the amount will become 125000e26 which is wrong and very high

Impact

Due to the incorrect cost calculation, the user spends more USDC than intended and receives fewer Zeno tokens than they should. This happens because the decimal misalignment inflates the cost, leading to an unfair exchange.

Recommendations

To normalize the cost and ensure it's in 6 decimals (USDC precision), divide by the appropriate decimal factor.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Auction.sol's buy() function multiplies ZENO amount (18 decimals) by price (6 decimals) without normalization, causing users to pay 1 trillion times the intended USDC amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.