krot-0025 - User may lost funds if they input wrong data in exchangeRateNumerator and exchangeRateDenominator

[sherlock-admin2]

krot-0025

Medium

User may lost funds if they input wrong data in exchangeRateNumerator and exchangeRateDenominator

Summary

When the user invest using the function invest() they input the data in the InvestParams where there is a field of exchangeRateNumerator and exchangeRateDenominator which helps in calculating fees and stable amount before and after fees. It can lead to loss of fund if they are depositing 6 decimal tokens and using exchange Rate as 18 decimal value. It will result in loosing funds for them. As if the data is incorrectly filled then Ex:

• Suppose user wants to 2 tokens which means 2 * 10**6
• But user enters exchangeRateNumerator and exchangeRateDenominator as 10 ** 18 decimals
• Now after the calculation preFeeStableAmountEquivalent becomes 2 * 10 ** 24 and postFeeStableAmountEquivalent will becomes 0.1 * 10 ** 18
• So As we can see user will invest 2 tokens but the stable amount will be only 0.1 which will result in loss for the user.

Root Cause

There should be a check that the user entering the data in the InvestParam while investing using the function invest(). We can check the decimal token of the user which they are going to invest and we should match it with the exchangeRate values if it's correct then only they can process the transaction otherwise it should revert or it should show error.
https://github.com/sherlock-audit/2024-11-vvv-exchange-update/blob/main/vvv-platform-smart-contracts/contracts/vc/VVVVCInvestmentLedger.sol#L141-L205

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

User will loose funds if the data is incorrectly filled in the InvestParams while calling invest()
Loss of funds because of incorrect InvestParams.

PoC

No response

Mitigation

Try checking the decimal of the token along with the decimal amount entered in exchangeRateNumerator and exchangeRateDenominator in InvestParams.