incorrect check in decoding well data via decodeWellData can lead to wrong scaling of reserves and wrong calculations

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-07-basin/blob/7d5aacbb144d0ba0bc358dfde6e0cc913d25310e/src/functions/Stable2.sol#L317

Vulnerability details

Impact

Stable2::decodeWellData incorrectly assumes the decimal precision of decimal1 based on provided value for decimal0.If this not the case (i.e. decimal1 != decimal0) then the reserves will be incorrectly scaled and well calculations will be incorrect.

Proof of Concept

    function decodeWellData(bytes memory data) public view virtual returns (uint256[] memory decimals) {
        (uint256 decimal0, uint256 decimal1) = abi.decode(data, (uint256, uint256));

        // if well data returns 0, assume 18 decimals.
        if (decimal0 == 0) {
            decimal0 = 18;
        }
->      if (decimal0 == 0) {
            decimal1 = 18;
        }
        if (decimal0 > 18 || decimal1 > 18) revert InvalidTokenDecimals();

        decimals = new uint256[](2);
        decimals[0] = decimal0;
        decimals[1] = decimal1;
    }

From the above code snippet, we can see that the value of decimal0 is used to set decimal1. This can be an issue when decimal0 is 0 but decimal1 is not ,or decimal1 is 0 but decimal0 is not, as token reserves will be incorrectly scaled leading to wrong calculations.

Tools Used

Manual Review

Recommended Mitigation Steps

 function decodeWellData(bytes memory data) public view virtual returns (uint256[] memory decimals) {
        (uint256 decimal0, uint256 decimal1) = abi.decode(data, (uint256, uint256));

        // if well data returns 0, assume 18 decimals.
        if (decimal0 == 0) {
            decimal0 = 18;
        }
-       if (decimal0 == 0) {
+       if (decimal1 == 0) {
            decimal1 = 18;
        }
        if (decimal0 > 18 || decimal1 > 18) revert InvalidTokenDecimals();

        decimals = new uint256[](2);
        decimals[0] = decimal0;
        decimals[1] = decimal1;
    }

Assessed type

Decimal

[c4-judge]

alex-ppg changed the severity to 3 (High Risk)

[c4-judge]

alex-ppg marked the issue as satisfactory