search

code-423n4 / 2022-04-backd-findings

6 stars 4 forks source link

[WP-M12] Tokens with decimals larger than `18` are not supported #126

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-04-backd/blob/c856714a50437cb33240a5964b63687c9876275b/backd/contracts/strategies/StrategySwapper.sol#L287-L289

Vulnerability details

In swapAllForWeth() and swapAllWethForToken, when using tokens with decimals larger than 18, the txs will revert due to underflow at _decimalMultiplier.

https://github.com/code-423n4/2022-04-backd/blob/c856714a50437cb33240a5964b63687c9876275b/backd/contracts/strategies/StrategySwapper.sol#L287-L289

function _decimalMultiplier(address token_) internal view returns (uint256) {
    return 10**(18 - IERC20Full(token_).decimals());
}
chase-manning commented 2 years ago

Duplicate of #49