Open code423n4 opened 3 years ago
If both Token (T) and LockToken (LT) are 18 decimals
and 1 LT = 10 T meaning 1 10*18 = 10 * 10**18
Which means 100 LT wil be 1000 T
100 (18 decimals) * LTxT / 10**18 = 1000 (18 decimals)
Which means 1000 T will be 100 LT
1000 (18 decimals) * TxLT / 10**18 = 100 (18 decimals)
So far so good, this was an example with an 18 decimal token, but afaik, the same logic applies to a 6 (or whatever) decimal token.
If T is 6 decimals and LT 18 decimals
and 1 LT = 10 T meaning 1 10*18 = 10 * 10**6
Which means 100 LT wil be 1000 T
100 (18 decimals) * LTxT / 10**18 = 1000 (6 decimals)
Which means 1000 T will be 100 LT
1000 (6 decimals) * TxLT / 10**18 = 100 (18 decimals)
Added this in a test btw, https://github.com/sherlock-protocol/sherlock-v1-core/blob/main/test/Pool.js#L844
After discussing this finding with the warden it was concluded this is a non-issue.
Handle
cmichel
Vulnerability details
The
PoolBase.TokenToLockXRate
function returns the "Current exchange rate from_token
to lockToken".It does not specify the precision and according to the documentation, it sounds like one just has to multiply this value by any
_token
amount to get the correspondinglockToken
amount. Lock tokens are always in 18 decimals (as is their initial mint) but_token
does not have to be. The return valueTokenToLock(10**18, _token) = totalLock * 1e18 / balance
has the wrong precision, it should returnTokenToLock(10**(_token.decimals()), _token)
instead returning the lock amount per "1.0"_token
.