Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Wrong decimals used when minting zeno tokens

olugbenga

Vulnerability Details

Users can buy amount of zeno tokens with usdc when the auction is active using the buy function.

function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice();
uint256 cost = price * amount;
require(usdc.transferFrom(msg.sender, businessAddress, cost), "Transfer failed");
​
bidAmounts[msg.sender] += amount;
state.totalRemaining -= amount;
state.lastBidTime = block.timestamp;
state.lastBidder = msg.sender;
​
zeno.mint(msg.sender, amount);
emit ZENOPurchased(msg.sender, amount, price);
}

Going by the test suites, we can see that the auction price is in USDC's 6 decimals and the buy amount is the amount of zeno tokens to buy without any decimals

startingPrice = ethers.parseUnits("100", 6); // 100 USDC
reservePrice = ethers.parseUnits("10", 6); // 10 USDC
--------------------------------------------------------------
const amountToBuy = 5; // amount of zeno tokens to buy
.....
await auction1.connect(addr1).buy(amountToBuy); // buy transaction

The issue arises because the buyfunction mints the exact buy amountwithout adding zeno token decimal(18). So Instead of minting 5e18 of zeno tokens to the user, in this case, it mints just 5.

Impact

Users buying zeno tokens get an amount that is order of magnitude lower than what they're supposed to get.

Tools Used

Manual

Recommendations

Mint the correct amount to the user

zeno.mint(msg.sender, amount * 1e18);
Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Auction.sol's buy() function multiplies ZENO amount (18 decimals) by price (6 decimals) without normalization, causing users to pay 1 trillion times the intended USDC amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.