Maia DAO Ecosystem - ubermensch's results

Lines of code

https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/ulysses-omnichain/BranchBridgeAgent.sol#L1340-L1342

Vulnerability details

Impact

The _normalizeDecimals function, in its current implementation, could lead to incorrect balance calculations and token transfers, affecting any mechanism in the system that relies on it.

Proof of Concept

The _normalizeDecimals function's formula should be _amount * (1 ether) / (10 ** _decimals) to correctly normalize to 18 decimals. But the current implementation uses _amount * (10 ** _decimals) / 1 ether, which results in incorrect conversions.

Additionally, tokens with decimals greater than 18 aren't correctly handled.

Tools Used

Manual Review

Recommended Mitigation Steps

The _normalizeDecimals function should be revised to correctly normalize amounts to 18 decimals. Here's a proposed implementation:

function _normalizeDecimals(uint256 _amount, uint8 _decimals) internal pure returns (uint256) {
    return _decimals == 18 ? _amount : _amount * (10 ** (18 - _decimals));
}

This new implementation ensures that the correct normalization is applied and it only accepts tokens with decimals less than or equal to 18.

Assessed type

Decimal