Abracadabra Mimswap - zhaojie's results

Lines of code

https://github.com/code-423n4/2024-03-abracadabra-money/blob/1f4693fdbf33e9ad28132643e2d6f7635834c6c6/src/oracles/aggregators/MagicLpAggregator.sol#L37

Vulnerability details

Impact

Tokens with decimals greater than 18 cannot be processed.

Proof of Concept

MagicLpAggregator In the constructor, takes the decimals of the base token and quote token:

    constructor(IMagicLP pair_, IAggregator baseOracle_, IAggregator quoteOracle_) {
        pair = pair_;
        baseOracle = baseOracle_;
        quoteOracle = quoteOracle_;
        baseDecimals = IERC20Metadata(pair_._BASE_TOKEN_()).decimals();
        quoteDecimals = IERC20Metadata(pair_._QUOTE_TOKEN_()).decimals();
    }

In the latestAnswer function, WAD - xx.decimals is used:

    function latestAnswer() public view override returns (int256) {
@>      uint256 baseAnswerNomalized = uint256(baseOracle.latestAnswer()) * (10 ** (WAD - baseOracle.decimals()));
@>      uint256 quoteAnswerNormalized = uint256(quoteOracle.latestAnswer()) * (10 ** (WAD - quoteOracle.decimals()));
        uint256 minAnswer = baseAnswerNomalized < quoteAnswerNormalized ? baseAnswerNomalized : quoteAnswerNormalized;

        (uint256 baseReserve, uint256 quoteReserve) = _getReserves();
@>      baseReserve = baseReserve * (10 ** (WAD - baseDecimals));
@>      quoteReserve = quoteReserve * (10 ** (WAD - quoteDecimals));
        return int256(minAnswer * (baseReserve + quoteReserve) / pair.totalSupply());
    }

WAD is a value of type uint256, equal to 18:

    uint256 public constant WAD = 18;

Therefore, if token.decimals is greater than 18, negative numbers will appear, whereas values of type uint do not allow negative numbers, so will revert. Therefore, MagicLpAggregator will not be able to handle tokens with decimals greater than 18.

Tools Used

vscode, manual

Recommended Mitigation Steps

Consider the case where decimals are greater than 18

Assessed type

Decimal