Broken convertToUsdValue calculation on tokens that have more than 18 decimal places

Severity

Low Risk

Relevant GitHub Links

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXReader.sol#L67

Vulnerability Details

In GMXReader.sol:67, the function convertToUsdValue is designed to calculate the market value of a given amount of tokens. However, the function assumes that all tokens operate with 18 or fewer decimal places. The code uses a fixed subtraction method (18 - IERC20Metadata(token).decimals()) that will revert if a token has more than 18 decimal places, thus breaking the calculation.

Impact

The impact of this vulnerability is low in terms of probability due to the rarity of tokens with more than 18 decimals, but if such a token were used, it would render the calculation and consequently the function inoperable.

Tools Used

Manual Review

Recommendations

To safely normalize the amt to 18 decimal places, the calculation should be adjusted as follows:

return (amt * self.chainlinkOracle.consultIn18Decimals(token)) / (10 ** IERC20Metadata(token).decimals());