Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Math will broke if token decimal is more than 18 #19

Closed
code423n4 opened this issue Sep 15, 2022 · 2 comments
Closed

Math will broke if token decimal is more than 18 #19

code423n4 opened this issue Sep 15, 2022 · 2 comments
Labels
bug Something isn't working duplicate This issue or pull request already exists invalid This doesn't seem right QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax sponsor disputed Sponsor cannot duplicate the issue, or otherwise disagrees this is an issue unsatisfactory does not satisfy C4 submission criteria; not eligible for awards

Comments

@code423n4
Copy link
Contributor

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/ac3e86f07bc2f1f51148d2265cc897e8b494adf7/src/oracles/PegOracle.sol#L73

Vulnerability details

Impact

Math will broke if token decimal is more than 18.

Proof of Concept

https://github.com/code-423n4/2022-09-y2k-finance/blob/ac3e86f07bc2f1f51148d2265cc897e8b494adf7/src/oracles/PegOracle.sol#L73

Tools Used

code analytics

Recommended Mitigation Steps

Fix math or add check in constructor for token decimals.
@code423n4 code423n4 added 3 (High Risk) Assets can be stolen/lost/compromised directly bug Something isn't working labels Sep 15, 2022
code423n4 added a commit that referenced this issue Sep 15, 2022
@code423n4
DimitarDimitrov issue #19
0788e04
@MiguelBits MiguelBits mentioned this issue Sep 21, 2022
Closed
@MiguelBits MiguelBits added the duplicate This issue or pull request already exists label Sep 23, 2022
@0xnexusflip 0xnexusflip added resolved Finding has been patched by sponsor (sponsor pls link to PR containing fix) sponsor confirmed Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity") labels Sep 28, 2022
@0xnexusflip 0xnexusflip removed resolved Finding has been patched by sponsor (sponsor pls link to PR containing fix) sponsor confirmed Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity") labels Sep 29, 2022
@MiguelBits MiguelBits added sponsor disputed Sponsor cannot duplicate the issue, or otherwise disagrees this is an issue and removed duplicate This issue or pull request already exists labels Oct 3, 2022
@HickupHH3 HickupHH3 added the unsatisfactory does not satisfy C4 submission criteria; not eligible for awards label Oct 17, 2022
@HickupHH3
Copy link
Collaborator

dup of #130.

TBH, details are lacking. Warden should elaborate a little more on why the "math will broke"

@HickupHH3 HickupHH3 added the duplicate This issue or pull request already exists label Oct 17, 2022
@HickupHH3
Copy link
Collaborator

part of #24

@HickupHH3 HickupHH3 added QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax and removed 3 (High Risk) Assets can be stolen/lost/compromised directly unsatisfactory does not satisfy C4 submission criteria; not eligible for awards labels Oct 17, 2022
@HickupHH3 HickupHH3 added the unsatisfactory does not satisfy C4 submission criteria; not eligible for awards label Nov 10, 2022
@JeeberC4 JeeberC4 added the invalid This doesn't seem right label Nov 10, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working duplicate This issue or pull request already exists invalid This doesn't seem right QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax sponsor disputed Sponsor cannot duplicate the issue, or otherwise disagrees this is an issue unsatisfactory does not satisfy C4 submission criteria; not eligible for awards
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@MiguelBits @code423n4 @HickupHH3 @JeeberC4 @0xnexusflip