Canto Application Specific Dollars and Bonding Curves for 1155s - 0xluckhu's results

Lines of code

https://github.com/code-423n4/2023-11-canto/blob/486d0723d686964a6dacc93ae0e1876705b4aa6b/asD/src/asD.sol#L76

Vulnerability details

Impact

In function asD::withdrawCarry(), it uses wrong scale factor (1e28) in the calculation of the maximum withdrawable NOTE, while the correct scale factor to be removed shall be 1e18. As a result, the owner can withdraw less interest than expected (meaning most interests are locked in cNote).

Proof of Concept

Check below code to calculate the maximum withdrawable NOTE in asD::withdrawCarry(): uint256 maximumWithdrawable = (CTokenInterface(cNote).balanceOf(address(this)) * exchangeRate) /1e28 -totalSupply();

1. CTokenInterface(cNote).balanceOf(address(this)) holds the decimals of cNote.decimals.
2. exchangeRate holds the decimals of Note.decimals*1e18/cNote.decimals. Based on 1,2, (CTokenInterface(cNote).balanceOf(address(this)) * exchangeRate) has the decimals of Note.decimals*1e18. As a result, in order to keep the Note.decimals for the calculated maximumWithdrawable, it shall remove the scale factor of 1e18 instead of 1e28.

Tools Used

Recommended Mitigation Steps

https://github.com/code-423n4/2023-11-canto/blob/486d0723d686964a6dacc93ae0e1876705b4aa6b/asD/src/asD.sol#L76 Correct 1e28 to 1e18.

Assessed type

Decimal