Incorrect Decimals Conversion in Curve2PoolAdapter::primitiveOutputAmount Function

[c4-bot-5]

Lines of code

https://github.com/code-423n4/2023-11-shellprotocol/blob/main/src/adapters/Curve2PoolAdapter.sol#L152

Vulnerability details

Impact

The bug in the primitiveOutputAmount function can lead to incorrect decimal conversions when calculating the rawInputAmount. The rawInputAmount is calculated using the _convertDecimals function, but the decimals parameter passed to _convertDecimals is decimals[inputToken], which retrieves the decimals of the input token. This is incorrect, as it should be decimals[outputToken] to retrieve the decimals of the output token. As a result, the calculated rawInputAmount may be based on the wrong decimal precision, leading to inaccurate calculations and potential loss of funds.

Proof of Concept

The bug can be observed in the following code snippet from the primitiveOutputAmount function:

152        uint256 rawInputAmount = _convertDecimals(NORMALIZED_DECIMALS, decimals[inputToken], inputAmount);

https://github.com/code-423n4/2023-11-shellprotocol/blob/main/src/adapters/Curve2PoolAdapter.sol#L152

Here, decimals[inputToken] should be replaced with decimals[outputToken] to correctly convert the inputAmount to the desired decimal precision.

Tools Used

Manual Review

Recommended Mitigation Steps

- uint256 rawInputAmount = _convertDecimals(NORMALIZED_DECIMALS, decimals[inputToken], inputAmount);

+ uint256 rawInputAmount = _convertDecimals(NORMALIZED_DECIMALS, decimals[outputToken], inputAmount);

This change ensures that the rawInputAmount is calculated using the correct decimal precision based on the output token.

Assessed type

Math

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #14

[c4-judge]

0xA5DF marked the issue as unsatisfactory: Invalid