search

code-423n4 / 2024-01-salty-findings

11 stars 6 forks source link

`decimal` function not available in all interfaces #586

Closed c4-bot-9 closed 9 months ago

c4-bot-9 commented 9 months ago

Lines of code

https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/stable/CollateralAndLiquidity.sol#L63 https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/stable/CollateralAndLiquidity.sol#L64

Vulnerability details

Impact

deployment of CollateralAndLiquidity contract can revert or return zero on these lines , due to functions that does not exits in the interface of old ERC20 tokens. 

  wbtcTenToTheDecimals = 10 ** IERC20Metadata(address(wbtc)).decimals();
  wethTenToTheDecimals = 10 ** IERC20Metadata(address(weth)).decimals();

Proof of Concept

decimals was added later to the erc20 interface and not all tokens use the interface that has decimals

Tools Used

manual

Recommended Mitigation Steps

use openzepplin contracts. limit to tokens that use the interface that decimals in the function list. or remove the lines that use decimals

Assessed type

Error