Submission Details
Severity:
In Auction.sol ` buy` allows for zero payments if zeno prices are near zero
Summary
Due to the rounding down behaviour of solidity, any zeno token price that is near zero especially when auction time is close to endtime will actually be rounded down to zero and users will get the token for free.
Vulnerability Details
the design of the auction appears to be a dutch auction.
as prices of the token reduce towards endtime, if the prices are for instance 0.2, it will be rounded down in solidity to 0, according to usdc buffering system
function buy(uint256 amount) external whenActive {
require(amount <= state.totalRemaining, "Not enough ZENO remaining");
uint256 price = getPrice(); function buy
*** uint256 cost = price * amount;
Impact
users will get tokens for free
Recommendations
upscale by multiplying by 10*18
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.