Inconsistent decimal handling in liquidity calculation
The _calcAddLiquidity function inconsistently handles decimal places during liquidity calculations:
The _calcAddLiquidity function inconsistently handles decimal places during liquidity calculations:
-
Initial Calculation (Correct):
- Uses
provDecimals(from price feed) when calculatingvalueChange:
solidity(tokenPrice, provDecimals) = _getLastPrice(_token);valueChange = (_amountIn * tokenPrice).toDecimals(tokenDecimals + provDecimals, 18); - Uses
-
LP Amount Calculation (Incorrect):
- Hardcodes 8 decimals instead of using
provDecimals:
soliditylpAmount = lpAmount.toDecimals(tokenDecimals + 8, plpDecimals); // Should use provDecimals - Hardcodes 8 decimals instead of using
This inconsistency occurs in both branches of the LP amount calculation (when lpSupply == 0 and the else case). The function assumes price feed decimals are always 8, which may not be true for all oracle providers.
Recommendations
Use proveDecimals consistently throughout the codebase to standardize handling of different token price decimal formats.
Report provenance
Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.