084.md

Formal Pecan Mongoose

Medium

Hardcoded 18 decimals for tokens will lead to issues with non 18 decimals tokens

Summary

https://github.com/sherlock-audit/2024-12-numa-audit/blob/main/Numa/contracts/nuAssets/nuAssetManager.sol#L195C5-L213C6

The functions ethToNuAsset and ethToNuAssetRoundUp incorrectly use a hardcoded value of 18 for the decimals parameter instead of retrieving the actual decimals of the nuAsset token.

Root Cause

https://github.com/sherlock-audit/2024-12-numa-audit/blob/main/Numa/contracts/nuAssets/nuAssetManager.sol#L195C5-L213C6

function ethToNuAsset(
    address _nuAsset,
    uint256 _amount
) public view returns (uint256 EthValue) {
    require(contains(_nuAsset), "bad nuAsset");
    nuAssetInfo memory info = getNuAssetInfo(_nuAsset);
    (address priceFeed, uint128 heartbeat) = (info.feed, info.heartbeat);
    return ethToToken(_amount, priceFeed, heartbeat, 18);
}


function ethToNuAssetRoundUp(
    address _nuAsset,
    uint256 _amount
) public view returns (uint256 EthValue) {
    require(contains(_nuAsset), "bad nuAsset");
    nuAssetInfo memory info = getNuAssetInfo(_nuAsset);
    (address priceFeed, uint128 heartbeat) = (info.feed, info.heartbeat);
    return ethToTokenRoundUp(_amount, priceFeed, heartbeat, 18);
}

The functions ethToNuAsset and ethToNuAssetRoundUp incorrectly use a hardcoded value of 18 for the decimals parameter instead of retrieving the actual decimals of the nuAsset token. Although we are not sure which synthetics tokens will be used, if the tokens have decimals other than 18. This will be problematic.

By hardcoding the decimals to 18, the ethToNuAsset functions assume that all nuAsset tokens have 18 decimal places, which may not be true. If a nuAsset token has a different number of decimals (e.g., 6 or 8), the conversion calculations will be incorrect. This can lead to erroneous token amounts being calculated and potentially cause significant financial discrepancies.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

No response

PoC

No response

Mitigation

To fix this issue, the ethToNuAsset and ethToNuAssetRoundUp functions should retrieve the actual decimals of the nuAsset token, just like the other functions do. Here's the corrected code.

function ethToNuAsset( address _nuAsset, uint256 _amount ) public view returns (uint256 EthValue) { require(contains(_nuAsset), "bad nuAsset"); nuAssetInfo memory info = getNuAssetInfo(_nuAsset); (address priceFeed, uint128 heartbeat) = (info.feed, info.heartbeat); return ethToToken(_amount, priceFeed, heartbeat, IERC20Metadata(_nuAsset).decimals()); }

function ethToNuAssetRoundUp( address _nuAsset, uint256 _amount ) public view returns (uint256 EthValue) { require(contains(_nuAsset), "bad nuAsset"); nuAssetInfo memory info = getNuAssetInfo(_nuAsset); (address priceFeed, uint128 heartbeat) = (info.feed, info.heartbeat); return ethToTokenRoundUp(_amount, priceFeed, heartbeat, IERC20Metadata(_nuAsset).decimals()); }