Core Contracts
Regnum Aurum Acquisition Corp
HardhatReal World AssetsNFT
77,280 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

USDC decimals are not accounted in `ZENO.redeem()`

dentonylifer

Summary

USDC decimals are not accounted in ZENO.redeem(), which allows to steal all USDC from ZENO.

Vulnerability Details

Link

Per docs and code, USDC will be used to buy ZENO tokens. In auctiion users will pay scaled amount of USDC using dynamic price calculation due to low decimals (6). But USDC decimals are not accounted in ZENO.redeem(), and convertion rate is always 1:1, which is wrong, because ZENO has default 18 decimals.

function redeemAll() external nonReentrant {
if (!isRedeemable()) {
revert BondNotRedeemable();
}
​
uint256 amount = balanceOf(msg.sender);
totalZENORedeemed += amount;
_burn(msg.sender, amount);
USDC.safeTransfer(msg.sender, amount);
}

For example, price of 1 ZENO at the moment when user called Auction.buy() was 1 USDC. User bought 100 ZENO (100e18). Now user can withdraw 100 USDC (100e6) only for 0.0...001 ZENO (100e6).

Impact

User can steal all USDC from Zeno contract by redeeming ZENO.

Tools Used

Manual review.

Recommendations

Use convertion rate when redeeming ZENO and scale USDC amount to 18 decimals.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Decimal precision mismatch between ZENO token (18 decimals) and USDC (6 decimals) not accounted for in redemption, causing calculation errors and incorrect payments

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.