L-09. Broken `convertToUsdValue` calculation on tokens that have more than 18 decimal places

Submitted by asimaranov, 0xhals, tychaios, jprod15. Selected submission by: tychaios.

Relevant GitHub Links

Vulnerability Details

In GMXReader.sol:67, the function convertToUsdValue is designed to calculate the market value of a given amount of tokens. However, the function assumes that all tokens operate with 18 or fewer decimal places. The code uses a fixed subtraction method (18 - IERC20Metadata(token).decimals()) that will revert if a token has more than 18 decimal places, thus breaking the calculation.


The impact of this vulnerability is low in terms of probability due to the rarity of tokens with more than 18 decimals, but if such a token were used, it would render the calculation and consequently the function inoperable.

Tools Used

Manual Review


To safely normalize the amt to 18 decimal places, the calculation should be adjusted as follows:
plain text
return (amt * self.chainlinkOracle.consultIn18Decimals(token)) / (10 ** IERC20Metadata(token).decimals());