Mixed-decimals math without explicit scaling

Evidence summary #

The HubPool manages LP tokens denominated in underlying asset decimals; the Arbitrum CustomGasToken critical finding showed that cross-decimal arithmetic without explicit scaling did occur in one adapter before it was fixed. The fix in PR #589 confirms the team corrected this. Core SpokePool/HubPool deposit/fill flows deal with token amounts where explicit scaling is required; the OZ audit pattern for this protocol involves recurring decimal/scaling scrutiny. Assessed yellow: one confirmed hi...

Sources #

Methodology #

Determine whether shared numerator/denominator arithmetic operates over tokens with different decimals without WAD/RAY normalization or explicit decimal-adjustment.

See the full factor methodology and distribution across all protocols →