Mixed-decimals math without explicit scaling
Convex Finance's assessment for RD-F-017 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
ExtraRewardStashV3 handles arbitrary ERC-20 reward tokens that may have non-18 decimals. Without a full Slither run on the complete source tree, cross-decimal arithmetic paths cannot be authoritatively assessed. Core tokens (CRV, CVX, LP) are all 18 decimals so the primary deposit/reward path has no mixed-decimal issue. Gray pending tool run on wrapper contracts.
Sources #
- GitHubConvex ExtraRewardStashV3.sol source (arbitrary ERC-20 reward tokens)ExtraRewardStashV3.sol - handles arbitrary reward tokensretrieved 2026-05-16
- Slither mixed-decimal detector run needed on wrapper contractsTool run needed for mixed-decimal assessmentretrieved 2026-05-16
Methodology #
Determine whether shared numerator/denominator arithmetic operates over tokens with different decimals without WAD/RAY normalization or explicit decimal-adjustment.
See the full factor methodology and distribution across all protocols →