Closed code423n4 closed 2 years ago
Given that centralization, risk is acknowledged (e.g. making an off-chain error in creating the ZcToken) and the fact that the functions the warden references are view functions, I believe this is QA.
It is informational because I believe an incorrect constructor call to the ZcToken
could cause unintended consequences with respect to decimal precision throughout the protocol.
Grouping this with the warden’s QA report #164
Duplicate of #164
Lines of code
https://github.com/code-423n4/2022-07-swivel/blob/fd36ce96b46943026cb2dfcb76dfa3f884f51c18/Creator/ZcToken.sol#L32-L35
Vulnerability details
Impact
The
constructor
of theZcToken
contract sets the underlying asset and the number of decimal places of theZcToken
. In case that this value is different to the underlying asset, the user may lose or send more tokens than expected.Proof of Concept
In the
ZcToken
contract there are two methods:convertToPrincipal
andconvertToUnderlying
, and in neither of them a conversion is performed taking into account that the decimals of theERC5095
and theunderlying
may be different, so if users wants to use them to convert the quantity to transfer, they may get the wrong value and an action may occur in an unwanted amount. The redeem and withdraw methods can produce errors.Affected source code:
Recommended Mitigation Steps