The constructor assume 18 decimals for underlying token incorrectly due to low-level static call fails

[c4-bot-9]

Lines of code

https://github.com/code-423n4/2024-03-pooltogether/blob/480d58b9e8611c13587f28811864aea138a0021a/pt-v5-vault/src/PrizeVault.sol#L304-L305
https://github.com/code-423n4/2024-03-pooltogether/blob/480d58b9e8611c13587f28811864aea138a0021a/pt-v5-vault/src/PrizeVault.sol#L772-L783

Vulnerability details

Impact

PrizeVault::_underlyingDecimals sets to 18 decimals incorrectly when low-level static call in function PrizeVault::_tryGetAssetDecimals() fails due to reasons like insufficient gas / target contract deployment failure, etc.

Proof of Concept

function _tryGetAssetDecimals(IERC20 asset_) internal view returns (bool, uint8) {
    (bool success, bytes memory encodedDecimals) = address(asset_).staticcall(
        abi.encodeWithSelector(IERC20Metadata.decimals.selector)
    );
    if (success && encodedDecimals.length >= 32) {
        uint256 returnedDecimals = abi.decode(encodedDecimals, (uint256));
        if (returnedDecimals <= type(uint8).max) {
            return (true, uint8(returnedDecimals));
        }
    }
    return (false, 0);
}

When (bool success, bytes memory encodedDecimals) = address(asset_).staticcall( abi.encodeWithSelector(IERC20Metadata.decimals.selector) ); fails due to reasons mentioned above, return (false, 0);

In constructor call :

(bool success, uint8 assetDecimals) = _tryGetAssetDecimals(asset_);
        _underlyingDecimals = success ? assetDecimals : 18;

PrizeVault::_underlyingDecimals sets to 18 decimals while other token does not have 18 decimals.

Tools Used

Manual Review

Recommended Mitigation Steps

1. Eliminate PrizeVault::_tryGetAssetDecimals()
2. adding _underlyingDecimals = asset_.decimals() in constructor;

constructor(
    string memory name_,
    string memory symbol_,
    IERC4626 yieldVault_,
    PrizePool prizePool_,
    address claimer_,
    address yieldFeeRecipient_,
    uint32 yieldFeePercentage_,
    uint256 yieldBuffer_,
    address owner_
)
    TwabERC20(name_, symbol_, prizePool_.twabController())
    Claimable(prizePool_, claimer_)
    Ownable(owner_)
{
    if (address(yieldVault_) == address(0)) revert YieldVaultZeroAddress();
    if (owner_ == address(0)) revert OwnerZeroAddress();

    IERC20 asset_ = IERC20(yieldVault_.asset());
    (bool success, uint8 assetDecimals) = _tryGetAssetDecimals(asset_);
-       _underlyingDecimals = success ? assetDecimals : 18;
+       _underlyingDecimals = asset_.decimals();
    _asset = asset_;

    yieldVault = yieldVault_;
    yieldBuffer = yieldBuffer_;

    _setYieldFeeRecipient(yieldFeeRecipient_);
    _setYieldFeePercentage(yieldFeePercentage_);
}

Assessed type

Decimal

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #25

[c4-pre-sort]

raymondfam marked the issue as duplicate of #172

[c4-judge]

hansfriese marked the issue as satisfactory

[c4-judge]

hansfriese changed the severity to QA (Quality Assurance)

[c4-judge]

hansfriese marked the issue as grade-c