Mixed-decimals math without explicit scaling
A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor detects whether the protocol performs arithmetic operations over token amounts with different decimal precisions -- for example, combining a 6-decimal USDC amount with an 18-decimal ETH amount in the same numerator or denominator -- without explicit WAD/RAY normalization or equivalent decimal-aware scaling. The assessment is performed by static analysis and source inspection, looking for arithmetic expressions that mix token amounts without consistent decimal normalization.
Why it matters
Mixed-decimals arithmetic produces values that differ by factors of 10^12 or more depending on which token is in the numerator. A protocol that divides an 18-decimal amount by a 6-decimal amount without scaling will produce a result 10^12 times larger than intended, or 10^12 times smaller. This class of error has caused approximately five documented hacks in the T-01 evidence base. Lending protocols that support multiple collateral types with different decimal precisions are the primary risk surface -- a single price or collateral calculation that mixes decimals can make an asset appear massively over- or under-valued.
Green / Yellow / Red
Green: all arithmetic operations involving token amounts explicitly normalize to a common precision (18 decimals / WAD / RAY or equivalent) before combining values across different token types. Yellow: normalization is applied in primary fund-movement functions but some peripheral calculations (e.g., display math, off-chain computation helpers) mix decimals without scaling. Red: any core collateral, exchange rate, or liquidation calculation mixes token amounts of different decimal precisions without explicit normalization.
Common gray cases
This factor is gray for single-asset protocols where all token amounts share the same decimal precision and mixed-decimals arithmetic is structurally impossible.
Notable historical examples
No hacks are currently linked in the database for this specific factor as a standalone causal driver. The factor is retained as P1 based on approximately five supporting instances in the T-01 vulnerability inventory.
Measurement what to look for#
Determine whether shared numerator/denominator arithmetic operates over tokens with different decimals without WAD/RAY normalization or explicit decimal-adjustment.