Incorrect decimal conversion in `LiquidityFaucet` calculation
In the _calcAddLiquidity function, the lpAmount conversion uses an incorrect decimal calculation:
In the _calcAddLiquidity function, the lpAmount conversion uses an incorrect decimal calculation:
function _calcAddLiquidity(address _token, uint256 _amountIn)internalviewreturns (uint256 netAmount, uint256 pFee, uint256 lpAmount, uint256 tokenPrice){--snip--if (lpSupply == 0) {lpAmount = netAmount * tokenPrice;lpAmount = lpAmount.toDecimals(tokenDecimals + 8, plpDecimals);} else {@1> lpAmount = netAmount.mulDiv(tokenPrice * lpSupply, _getPoolValue(false, false));@2> lpAmount = lpAmount.toDecimals(tokenDecimals + 8, plpDecimals);}}
At step @1>, the correct way to calculate the lpAmount decimals should be:
lpAmount decimals = (tokenDecimals * priceDecimals * plpDecimals) / poolValueDecimals(18)
However, at step @2>, the code incorrectly assumes that the decimals are tokenDecimals + 8 and attempts to convert it to plpDecimals. On the other hand, the code assumes that plpDecimals equals poolValueDecimals (18).
Using this incorrect formula for decimal conversion can lead to inaccurate LP token allocation, which directly impacts user shares and the overall integrity of the pool’s accounting.
Recommendations:
Update the lpAmount decimals conversion logic to use the correct decimal calculation.
Report provenance
Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.