Skip to content

Latest commit

 

History

History
49 lines (31 loc) · 1.38 KB

012.md

File metadata and controls

49 lines (31 loc) · 1.38 KB
Raw

Curved Topaz Boa

Medium

The assumption that the boost token will always have >= decimals of stable coin can be wrong

Summary

Since the protocol will support multiple chains having multiple stablecoins, it it possible for the stable coin to have decimals > 18. The Axion protocol will not support such tokens.

Root Cause

In all the below mentioned methods it is assumed that the boost token will always have >= 18 decimals. I'm mentioning all those instances below:

  1. https://github.com/sherlock-audit/2024-10-axion/blob/main/liquidity-amo/contracts/MasterAMO.sol#L332C5-L334C61
  2. https://github.com/sherlock-audit/2024-10-axion/blob/main/liquidity-amo/contracts/MasterAMO.sol#L336C5-L338C6
  3. https://github.com/sherlock-audit/2024-10-axion/blob/main/liquidity-amo/contracts/SolidlyV3AMO.sol#L343C5-L355C6

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

The protocol won't be able to support such tokens where the decimals are >18.

PoC

No response

Mitigation

Adding the below check will be enough.

function toUsdAmount(uint256 boostAmount) internal view returns (uint256) {
    if(boostDecimals > usdDecimals) {
        return boostAmount / 10 ** (boostDecimals - usdDecimals);
    } else {
        return boostAmount / 10 ** (usdDecimals - boostDecimals);
    }
}