[Lines of code](https://github.com/code-423n4/2023-03-wenwin/blob/91b89482aaedf8b8feb73c771d11c257eed997e8/src/LotterySetup.sol#L164) # Vulnerability details ## Impact If the rewardToken has less than 16 decimals, users will not be able to claim the correct value of their prize. > Try not to think it will be DAI only. We will probably use DAI for the first product, but think more in general approach [@0xluckydev]()#5064 It is not the case with DAI (since it has 18 decimals), but it would be an issue with USDC and USDT for example. ## Proof of Concept In the TestToken.sol, add the following function to change the number of decimals easily: function decimals() public pure override returns (uint8) { return 18; } Run forge test --match-test testFixedReward -vvvv with different values of decimals() like 18 (should pass) and 6 (the test will not pass). In the function packFixedRewards (LotterySetup.sol), uint8 reward is overflowed when a low decimal token is used function packFixedRewards(uint256[] memory rewards) private view returns (uint256 packed) { if (rewards.length != (selectionSize) || rewards[0] != 0) { revert InvalidFixedRewardSetup(); } uint256 divisor = 10 ** (IERC20Metadata(address(rewardToken)).decimals() - 1); for (uint8 winTier = 1; winTier < selectionSize; ++winTier) { uint16 reward = uint16(rewards[winTier] / divisor); if ((rewards[winTier] % divisor) != 0) { revert InvalidFixedRewardSetup(); } packed |= uint256(reward) << (winTier * 16); } } In order to reproduce the following outputs, you will need to update LotterySetup.sol : * Add the import "forge-std/Test.sol"; * Inherit from Test so we can have console.log contract LotterySetup is ILotterySetup, Test { * Update the packFixedRewards function (it will just add some console.log statements) function packFixedRewards(uint256[] memory rewards) private view returns (uint256 packed) { if (rewards.length != (selectionSize) || rewards[0] != 0) { revert InvalidFixedRewardSetup(); } uint256 divisor = 10 ** (IERC20Metadata(address(rewardToken)).decimals() - 1); for (uint8 winTier = 1; winTier < selectionSize; ++winTier) { uint16 reward = uint16(rewards[winTier] / divisor); console.log("rewards[winTier] %s", rewards[winTier]); console.log("divisor %s", divisor); console.log("max U16 %s", type(uint16).max); console.log("reward %s", reward); console.log("rewards[winTier] %s", rewards[winTier]); if ((rewards[winTier] % divisor) != 0) { revert InvalidFixedRewardSetup(); } packed |= uint256(reward) << (winTier * 16); console.log("============="); } This is the result of the test for 18 decimals is the following : [![](https://camo.githubusercontent.com/d3beab04001560682ae252ec5c5f9bb07fe85cd231ec0643555bbd3f7ed9a90e/68747470733a2f2f6d642e70696361736f66742e6e65742f75706c6f6164732f75706c6f61645f63336330633539613564313362643039356137666539353965333531626135612e706e67)]() For 15 decimals, this is the result : [![](https://camo.githubusercontent.com/dc71d5511c83f784f1bf03a7bdff2d7c941a7955ebda7f9d89d3c6ed2cb66f2d/68747470733a2f2f6d642e70696361736f66742e6e65742f75706c6f6164732f75706c6f61645f34376665396135393330613633363434303530633231653263663330303333632e706e67)]() You can notice the value of the variable reward is decreasing because it can't be above type(uint16).max)); ## Tools Used Forge / Manual testing ## Recommended Mitigation Steps A way to fix the issue is to change the packFixedRewards and fixedReward functions. It will be a bit less gas efficient. function packFixedRewards(uint256[] memory rewards) private view returns (uint256 reward) { if (rewards.length != (selectionSize) || rewards[0] != 0) { revert InvalidFixedRewardSetup(); } uint256 divisor = 10 ** (IERC20Metadata(address(rewardToken)).decimals() - 1); for (uint8 winTier = 1; winTier < selectionSize; ++winTier) { reward = uint256(rewards[winTier] / divisor); /* console.log("rewards[winTier] %s", rewards[winTier]); console.log("divisor %s", divisor); console.log("max U16 %s", type(uint16).max); console.log("reward %s", reward); console.log("rewards[winTier] %s", rewards[winTier]); */ //console.log("reward %s", rewards); if ((rewards[winTier] % divisor) != 0) { revert InvalidFixedRewardSetup(); } /* packed |= uint256(reward); console.log("packed %s", packed); console.log("=================="); */ } } function fixedReward(uint8 winTier) public view override returns (uint256 amount) { if (winTier == selectionSize) { return _baseJackpot(initialPot); } else if (winTier == 0 || winTier > selectionSize) { return 0; } else { return nonJackpotFixedRewards * (10 ** (IERC20Metadata(address(rewardToken)).decimals() - 1)); } } Now the test pass : forge test --match-test testFixedReward -vvvv [![](https://camo.githubusercontent.com/12944af0a8e7e07673ee0cfc148383e69c931a39142c5df107ce852a73524412/68747470733a2f2f6d642e70696361736f66742e6e65742f75706c6f6164732f75706c6f61645f38346236316231313539326531383735343131363835306265396236383835352e706e67)]() --- The text was updated successfully, but these errors were encountered: All reactions

Query Builder