attens - When swapping 18-decimal token to 8-decimal token , user could buy decimal-18-token with 0 amount of decimal-8-token

[Attens1423]

medium

When swapping decimal-18-token to decimal-8-token , user could buy decimal-18-token with 0 amount of decimal-8-token

Summary

Due to calculation errors, users can purchase a certain quantity of 18-decimal tokens (such as DAI) using 8-decimal tokens with a quantity of 0 (e.g., WBTC on ETH).

Vulnerability Detail

Here is the poc:

uint256 payFromToken = d3Proxy.buyTokens(
            address(d3MM),
            user1,
            address(token1),
            address(token2),
            10000000,
            0,
            abi.encode(swapData),
            block.timestamp + 1000
        );
assertEq(payFromToken, 0);

Impact

It may cause unexpected loss

Tool Used

Manual Review

Recommendation

In buyToken() of D3Trading.sol, add this rule:

if(payFromAmount == 0) { // value too small
            payFromAmount = 1;
        }

[Attens1423]

https://github.com/DODOEX/new-dodo-v3/pull/37

[hrishibhat]

Please note: This issue is not part of the contest submissions and is not eligible for contest rewards.

[IAm0x52]

Fix looks good. Previously if swapping a lower precision token, the precision loss could be abused to by small amounts of higher DP tokens, though the amount gained would almost always be too small for any abuse profitably. 0 amount from token swaps are now always rounded up to 1.