Upgraded Q -> M from #97 [1674422838137]

[c4-judge]

Judge has assessed an item in Issue #97 as M risk. The relevant finding follows:

DOS StableVault deposit and withdraws if ERC20 with more than 18 decimals used. Description withdraw and deposit functions in StableVault will revert if ERC20 token with more than 18 decimals is used. This is due to an revert when trying to subtract the token decimals from hardcoded 18.

deposit: https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/StableVault.sol#L49

function deposit(address _token, uint256 _amount) public {
    require(allowed[_token], "Token not listed");
    IERC20(_token).transferFrom(_msgSender(), address(this), _amount);
    IERC20Mintable(stable).mintFor(
        _msgSender(),
        _amount*(10**(18-IERC20Mintable(_token).decimals()))
    );
}

Recommendation: Add a check that token decimals is under 18 in listToken. withdraw: https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/StableVault.sol#L67:

function withdraw(address _token, uint256 _amount) external returns (uint256 _output) {
    IERC20Mintable(stable).burnFrom(_msgSender(), _amount);
    _output = _amount/10**(18-IERC20Mintable(_token).decimals());
    IERC20(_token).transfer(
        _msgSender(),
        _output
    );
}

---

[c4-judge]

GalloDaSballo marked the issue as duplicate of #533

[c4-judge]

GalloDaSballo marked the issue as satisfactory