Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Decimal Mismatch in Redeem Function Leading to Incorrect USDC Transfer Upon ZENO Token Redemption

recur

Summary

In the redeem function of the Zeno.sol contract, users can redeem USDC by burning ZENO tokens. However, the function does not account for the decimal mismatch between ZENO tokens (which have 18 decimals) and USDC (which has 6 decimals). This leads to an incorrect transfer of USDC when users redeem their ZENO tokens. Specifically, if a user owns 100e18 ZENO tokens and attempts to redeem them, the contract will burn 100e18 tokens but incorrectly transfer 100e18 USDC. The transfer should have been scaled down to match the USDC decimal precision, i.e., it should transfer 100e6 USDC instead. This mismatch causes the user to receive an inflated amount of USDC.

Vulnerability Details

  • Decimal Mismatch: ZENO tokens use 18 decimals, while USDC uses 6 decimals. In the redeem function, the amount of ZENO tokens is directly transferred as USDC without adjusting for this difference in decimal places.

  • Incorrect Transfer: The code burns amount ZENO tokens (e.g., 100e18) but transfers an equal amount of USDC (e.g., 100e18). However, the correct transfer should involve scaling the amount by 1e12 (to account for the difference in decimals) so that the actual transfer is 100e6 USDC, not 100e18.

  • No Decimal Adjustment: The contract assumes that the ZENO token and USDC have the same number of decimals, which is not the case, leading to a miscalculation in the amount of USDC transferred.

function redeem(uint amount) external nonReentrant {
if (!isRedeemable()) {
revert BondNotRedeemable();
}
​
if (amount == 0) {
revert ZeroAmount();
}
​
uint256 totalAmount = balanceOf(msg.sender);
if (amount > totalAmount) {
revert InsufficientBalance();
}
​
totalZENORedeemed += amount;
_burn(msg.sender, amount);
@> issue USDC.safeTransfer(msg.sender, amount);
}

Impact

  • Incorrect USDC Transfer: Users are transferred an inflated amount of USDC compared to the number of ZENO tokens they burn. In the worst-case scenario, this could lead to significant financial losses for the contract's participants or the contract itself if exploited by malicious actors.

  • Financial Loss: Users may unintentionally redeem an excessive amount of USDC due to the lack of decimal handling. This could result in users receiving much more USDC than they should, creating potential exploit opportunities.

  • Loss of Funds for the Contract: If this issue is left unresolved, the contract may have to make up for the excess USDC transferred, leading to a depletion of funds or loss of assets.

Tools Used

Manual review

Recommendations

Handle the precison between Zeno and USDC, so that contract funds are lost.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Decimal precision mismatch between ZENO token (18 decimals) and USDC (6 decimals) not accounted for in redemption, causing calculation errors and incorrect payments

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.