Core Contracts

Summary

In the redeem function of the Zeno.sol contract, users are allowed to redeem USDC by burning their ZENO tokens. However, the function does not adjust for the differing decimal places between ZENO tokens (which use 18 decimals) and USDC (which uses 6 decimals). As a result, when a user burns, for example, 100e18 ZENO tokens, the contract erroneously transfers 100e18 USDC instead of the correct 100e6 USDC. This oversight leads to an inflated USDC transfer amount during redemption.

Vulnerability Details

• Decimal Mismatch:
  ZENO tokens are handled with 18 decimals, whereas USDC operates with 6 decimals. The redeem function fails to account for this difference.

• Incorrect Transfer Calculation:
  The function burns a specified amount of ZENO tokens (e.g., 100e18) and then transfers an equivalent amount of USDC. However, proper scaling should reduce the USDC amount to match the 6-decimal format, i.e., amount / 1e12.

• No Decimal Normalization:
  The redemption logic incorrectly assumes both token types have identical decimal precision, leading to a severe miscalculation in the USDC transferred.

Impact

• Excessive USDC Transfer:
  Users receive an excessively high amount of USDC when redeeming ZENO tokens, which could lead to substantial financial discrepancies.

• Potential Exploitation:
  Malicious actors might take advantage of this discrepancy to drain funds by redeeming tokens at an artificially high USDC rate.

• Contract Financial Risk:
  The protocol may suffer from depleted USDC reserves or other financial imbalances if the inflated transfers continue.

Tools Used

• Manual Code Review: The issue was identified through a detailed examination of the redeem() function.

Recommendations

1. Normalize Redemption Amount:
   Adjust the redemption logic to scale the amount by dividing by 1e12 to convert from 18 decimals (ZENO) to 6 decimals (USDC). For example:

   uint256 scaledAmount = amount / 1e12; // Convert ZENO amount to USDC decimals

   totalZENORedeemed += scaledAmount;

   _burn(msg.sender, amount);

   USDC.safeTransfer(msg.sender, scaledAmount);

   ​