Submission Details
Impact:
Likelihood:
Decimals Mismatch/Manipulation
Problem:
Decimals are set in the constructor and can be any value, but the contract does not enforce a reasonable range (e.g., 0–18).
Protocols may assume 6 or 18 decimals, leading to calculation errors or overflows.
Risk:
Protocols interacting with this token may miscalculate values, leading to overflows, underflows, or loss of funds.
Attacker can deploy a token with extreme decimals (e.g., 255), breaking integrations.
constructor(uint8 _tokenDecimals) ERC20("MockUSDC", "mUSDC") {
tokenDecimals = _tokenDecimals;
}
Proof of Concept
function testExtremeDecimals() public {
MockUSDC token = new MockUSDC(255); // Max uint8
token.mint(address(this), 1);
// token.balanceOf(address(this)) is now huge (1 * 10**255)
}
Recommended Mitigation
constructor(uint8 _tokenDecimals) ERC20("MockUSDC", "mUSDC") {
- tokenDecimals = _tokenDecimals;
+ require(_tokenDecimals <= 18, "Decimals too high");
+ tokenDecimals = _tokenDecimals;
}
Updates
Rewards breakdown
nSLOC
217This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.