ck - Lender::convertDecimals will return 0 when underlyingDecimals == principalDecimals

[github-actions[bot]]

ck

high

Lender::convertDecimals will return 0 when underlyingDecimals == principalDecimals

Summary

The convertDecimals() function will return a value of 0 when underlyingDecimals == principalDecimals because this condition is not accounted for. This will lead to loss of funds as convertDecimals() is relied on in lend and mint functions.

Vulnerability Detail

The convertDecimals() function converts principal decimal amount to underlying's decimal amount as below:

        // Determine which asset has more decimals
        if (underlyingDecimals > principalDecimals) {
            // Shift decimals accordingly
            return a * 10**(underlyingDecimals - principalDecimals);
        }
        return a / 10**(principalDecimals - underlyingDecimals);

It fails to account for a condition where underlyingDecimals == principalDecimals. In such a scenario, the function would return a 0 (default value of uint256). This can lead to a loss of funds and break critical functionality. For example, in the lend() function, the mintable amount would be set to 0 immediately after a transfer of funds has been done.

        // Transfer the users principal tokens to the lender contract
        Safe.transferFrom(IERC20(principal), msg.sender, address(this), a);

        // Calculate how much should be minted based on the decimal difference
        uint256 mintable = convertDecimals(u, principal, a);

Impact

This can lead to a loss of funds and break critical functionality.

Code Snippet

https://github.com/sherlock-audit/2023-01-illuminate/blob/main/src/Lender.sol#L1217-L1234 https://github.com/sherlock-audit/2023-01-illuminate/blob/main/src/Lender.sol#L376-L380

Tool used

Manual Review

Recommendation

Make the first condition check to be underlyingDecimals >= principalDecimals

        // Determine which asset has more decimals
        if (underlyingDecimals >= principalDecimals) {
            // Shift decimals accordingly
            return a * 10**(underlyingDecimals - principalDecimals);
        }
        return a / 10**(principalDecimals - underlyingDecimals);