Skip to content
high Arithmetic No SWC entry CWE-682

Incorrect Decimal / Token Unit Handling

SAFE-0084 Arithmetic Checked automatically by the scanner
1

What goes wrong

Mixing tokens of different decimals (e.g. USDC 6 vs WETH 18) without normalization produces valuations off by orders of magnitude, enabling theft or mispricing.

2

How to fix it

the pattern that is safe
uint8 d = IERC20Metadata(usdc).decimals();
uint v = amountUSDC * price / (10 ** d);
◆
Normalize decimals explicitly.
3

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

$223M · 2025 Cetus Protocol Arithmetic · 2025 $147M · 2021 Compound Finance Arithmetic · 2021 $128M · 2025 Balancer v2 Arithmetic · 2025 ~$50M · 2021 Uranium Finance Arithmetic · 2021
4

Related vulnerabilities in Arithmetic

SAFE-0016Integer Overflow / Underflow (pre-0.8 or unchecked) critical · Arithmetic SAFE-0018Rounding Error Exploitation high · Arithmetic SAFE-0017Division Before Multiplication Precision Loss medium · Arithmetic SAFE-0030Unsafe Type Casting / Downcast Truncation medium · Arithmetic SAFE-0121unchecked{} Block Hiding Over/Underflow medium · Arithmetic SAFE-0122Unsafe Downcast (uint256 → smaller) medium · Arithmetic SAFE-0219Reward-Per-Token Precision Loss medium · Arithmetic SAFE-0087Dust Accumulation / Rounding Residue Lockup low · Arithmetic
← PreviousEmergency Pause Missing / Pause Bypass
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0084 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs