Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

An incorrect amount of ZENO tokens will be minted

gkrastenov

Summary

The USDC token and ZENO token have different decimals, so the contract will mint the wrong amount of tokens because they are not scaled to 18 decimals.

Vulnerability Details

When the user buys ZENO tokens, they transfer USDC tokens. The ZENO token inherits the OpenZeppelin ERC20 contract, which has 18 decimals by default. This can be problematic because the USDC token has only 6 decimals on Mainnet.

An incorrect amount of tokens will be minted. The token should always be represented with 18 decimals, but the contract mints using 6 decimals. The contratc will mint wrong amount of tokens becuase they are not sclaed to the 18 decimals.

function mint(address to, uint256 amount) external onlyOwner {
if (amount == 0) {
revert ZeroAmount();
}
​
_mint(to, amount);
totalZENOMinted += amount;
}

Impact

An incorrect amount of tokens will be minted.

Tools Used

Mannual Review

Recommendations

Override the decimals function from OpenZeppelin ERC20 contract and set the ZEO token to 6 decimals, or scale the amount before minting the tokens.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Auction.sol's buy() function multiplies ZENO amount (18 decimals) by price (6 decimals) without normalization, causing users to pay 1 trillion times the intended USDC amount

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.