Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Auction don't handle decimals

0xphantom

Summary

Decimals are not handled at all in the Auction contract, making it unusable because the price is calculated per wei.

Vulnerability Details

When a user buys tokens, the protocol directly multiplies the token amount by the price, as seen here:

function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
uint256 cost = price * amount;
require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");
​

However, the token amount is expressed with 18 decimals, while the price is expressed with 6 decimals (matching USDC’s decimals). This results in the price being applied per wei, leading to a completely incorrect and nonsensical price calculation.

Example:

If the user sets the starting price to 100 USDC, then at the beginning of the auction:

• Buying one Zeno token (which equals 1e18)

• The user would have to pay:

1e18*100 USDC wei = 1e14 USDC tokens

• This results in an enormous and incorrect amount, making the auction contract unusable.

Impact

The auction is unusable

Tools Used

Manual review

Recommendations

the protocol should change the buy function to handle decimals :

function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
uint256 zenoDecimals = zeno.decimals();
​
uint256 cost = (price * amount)/zenoDecimals;
require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Auction.sol's buy() function multiplies ZENO amount (18 decimals) by price (6 decimals) without normalization, causing users to pay 1 trillion times the intended USDC amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.