Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-25·

Inconsistent decimal handling in liquidity calculation

Not reportedoptionsleverageblack-scholes
TL;DR

The _calcAddLiquidity function inconsistently handles decimal places during liquidity calculations:

Severity
LOW
Method
MManual review
CAT.

The _calcAddLiquidity function inconsistently handles decimal places during liquidity calculations:

  1. Initial Calculation (Correct):

    • Uses provDecimals (from price feed) when calculating valueChange:
    solidity
    (tokenPrice, provDecimals) = _getLastPrice(_token);
    valueChange = (_amountIn * tokenPrice).toDecimals(tokenDecimals + provDecimals, 18);
  2. LP Amount Calculation (Incorrect):

    • Hardcodes 8 decimals instead of using provDecimals:
    solidity
    lpAmount = lpAmount.toDecimals(tokenDecimals + 8, plpDecimals); // Should use provDecimals

This inconsistency occurs in both branches of the LP amount calculation (when lpSupply == 0 and the else case). The function assumes price feed decimals are always 8, which may not be true for all oracle providers.

Recommendations

Use proveDecimals consistently throughout the codebase to standardize handling of different token price decimal formats.

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-25