Tigris Trade contest - ak1's results

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/StableVault.sol#L44-L71

Vulnerability details

Impact

StableVault.sol : desposit , depositWithPermit and withdraw would revert.

TradingLibrary.sol : verifyPrice function would revert at line 115

Trading.sol : _handleDeposit function would revert at line 650, _handleWithdraw will fail at line 675.

Proof of Concept

From the listed pairs it is clear that the protocol is supporting the NEAR/USD - https://docs.tigris.trade/protocol/listed-pairs#:~:text=3-,NEAR/USD,-0.10%25

NEAR has decimal value of 24. https://etherscan.io/token/0x85f17cf997934a597031b2e18a9ab6ebd4b9f6a4

    function deposit(address _token, uint256 _amount) public {
    require(allowed[_token], "Token not listed");
    IERC20(_token).transferFrom(_msgSender(), address(this), _amount);
    IERC20Mintable(stable).mintFor(
        _msgSender(),
        _amount*(10**(18-IERC20Mintable(_token).decimals()))
    );
}


function depositWithPermit(address _token, uint256 _amount, uint256 _deadline, bool _permitMax, uint8 v, bytes32 r, bytes32 s) external {
    uint _toAllow = _amount;
    if (_permitMax) _toAllow = type(uint).max;
    ERC20Permit(_token).permit(_msgSender(), address(this), _toAllow, _deadline, v, r, s);
    deposit(_token, _amount);
}


/**
* @notice swap tigAsset to _token
* @param _token address of the token to receive
* @param _amount amount of _token
*/
function withdraw(address _token, uint256 _amount) external returns (uint256 _output) {
    IERC20Mintable(stable).burnFrom(_msgSender(), _amount);
    _output = _amount/10**(18-IERC20Mintable(_token).decimals());
    IERC20(_token).transfer(
        _msgSender(),
        _output
    );

StableVault.sol : both witdraw and deposit will revert due to the calculation at lines 49, 67

Tools Used

Manual review

Recommended Mitigation Steps

Kindly consider changing the subtraction from large to min instead of (18 - token decimal)