Caviar Private Pools - 0xWeiss's results

Lines of code

https://github.com/code-423n4/2023-04-caviar/blob/cd8a92667bcb6657f70657183769c244d04c015c/src/PrivatePool.sol#L733

Vulnerability details

Impact

The issue relies here:

https://github.com/code-423n4/2023-04-caviar/blob/cd8a92667bcb6657f70657183769c244d04c015c/src/PrivatePool.sol#L733

This line of code is related to the calculation of the exponent value, which is used to determine the number of decimal places for a given ERC20 token. Specifically, the issue is that this code is not capable of handling tokens with less than 3 decimals, as it will cause the token to be stuck and unchangeable.

The issue arises from the fact that the exponent value is calculated by subtracting 4 from the number of decimal places for the ERC20 token. This is done to obtain the correct number of decimal places for the token when performing mathematical operations.

However, if the token has less than 3 decimal places, this calculation will result in a negative value for the exponent, which will cause the token to become stuck and unchangeable.

It is unchangeable because changeFeeQuote is also used when changing the NFTs. So, if the baseToken is less than 4 decimals, you won't be able to change your NFTs because all transactions will fail.

https://github.com/code-423n4/2023-04-caviar/blob/cd8a92667bcb6657f70657183769c244d04c015c/src/PrivatePool.sol#L416

It is a medium and not a high because tokens of 3 decimals or less are not very common but the impact would be high. The issue arises also from the fact that Caviar has no documentation about admitting tokens with x decimals. There is not a single place where it says that tokens < than x decimals are not welcomed

Proof of Concept

It is a logical issue error, therefore no PoC is needed. But the steps for these to happen:

-Use baseToken in a pool as a token with < 4 decimals -People start using the pool with the token(if it is important enough) -People are not able to call change because the transaction fails while calling changeFeeQuote

Tools Used

Manual

Recommended Mitigation Steps

Either make support for <4 decimal tokens or clearly state that they are not supported