Submission Details
Severity:
`DebtToken` is using `rays` from `WadRayMath`, but should use `wads`
Summary
DebtToken is using rays from WadRayMath, but should use wads. Like instead of rayMul it should be wadMul
Vulnerability Details
On the WadRayMath library we can see wad is used for 18 decimals and ray is used for 27 decimals.
/**
* @title WadRayMath library
* @author Aave
* @notice Provides functions to perform calculations with Wad and Ray units
* @dev Provides mul and div function for wads (decimal numbers with 18 digits of precision) and rays (decimal numbers
* with 27 digits of precision) 👈👈
* @dev Operations are rounded. If a value is >=.5, will be rounded up, otherwise rounded down.
*/
library WadRayMath {
// HALF_WAD and HALF_RAY expressed with extended notation as constant with operations are not supported in Yul assembly
uint256 internal constant WAD = 1e18; 👈👈
uint256 internal constant HALF_WAD = 0.5e18;
uint256 internal constant RAY = 1e27; 👈👈
uint256 internal constant HALF_RAY = 0.5e27;
uint256 internal constant WAD_RAY_RATIO = 1e9;
uint256 internal constant SECONDS_PER_YEAR = 365 days;
On the DebtToken we can see it is inheriting from ERC20 from openzeppelin.
The ERC20 is actually 18 decimal token.
So that means the DebtToken is using rays which is wrong.
Recommendations
Use wads instead of rays
Like use wadMul instead of rayMul
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.