Make calculation using 1e18 but protocol allows tokens with different scale

[code423n4]

Lines of code

https://github.com/code-423n4/2023-01-numoen/blob/main/src/core/Lendgine.sol#L252-L257 https://github.com/code-423n4/2023-01-numoen/blob/main/src/core/Lendgine.sol#L252 https://github.com/code-423n4/2023-01-numoen/blob/main/src/core/Lendgine.sol#L257 https://github.com/code-423n4/2023-01-numoen/blob/main/src/periphery/LiquidityManager.sol#L178

Vulnerability details

Impact

Make calculation using 1e18 but protocol allows tokens with different scale.

Proof of Concept

Method: https://github.com/code-423n4/2023-01-numoen/blob/main/src/core/Lendgine.sol#L252-L257

Calculation: https://github.com/code-423n4/2023-01-numoen/blob/main/src/core/Lendgine.sol#L252 https://github.com/code-423n4/2023-01-numoen/blob/main/src/core/Lendgine.sol#L257 https://github.com/code-423n4/2023-01-numoen/blob/main/src/periphery/LiquidityManager.sol#L178

Factory: https://github.com/code-423n4/2023-01-numoen/blob/main/src/core/Factory.sol#L66-L77

Here in factory user can add tokens with scale from 6 to 18.

Tools Used

Static analytics Code reading

Recommended Mitigation Steps

Use tokens scale inside calculations

[c4-judge]

berndartmueller marked the issue as unsatisfactory: Invalid