Venus Prime - Hama's results

Lines of code

https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/Prime.sol#L661

Vulnerability details

Impact

The _calculateScore function in the contract may exhibit incorrect behavior when dealing with tokens that have a decimal precision greater than 18. This issue can lead to inaccurate score calculations, potentially impacting user assessments and decisions based on these scores.

Proof of Concept

function _calculateScore(address market, address user) internal returns (uint256) {
    uint256 xvsBalanceForScore = _xvsBalanceForScore(_xvsBalanceOfUser(user));

    IVToken vToken = IVToken(market);
    ...
    capital = capital * (10 ** (18 - vToken.decimals()));

    return Scores.calculateScore(xvsBalanceForScore, capital, alphaNumerator, alphaDenominator);
}

If a token has a decimal precision greater than 18 (e.g., 24 decimals like YAMv2), the adjustment in the code snippet above will not correctly account for the extra decimal places. This could lead to incorrect score calculations and potentially misrepresent the user's score.

Tools Used

Manual review

Recommended Mitigation Steps

Modify the _calculateScore function to dynamically adjust the capital value based on the token's actual decimal precision. This can be achieved by using the token's decimals() function or by obtaining this information from a trusted source.

Assessed type

Decimal