FonDevs - rounding down can cause address to to get free IBoostStablecoin tokens.

[sherlock-admin4]

FonDevs

High

rounding down can cause address to to get free IBoostStablecoin tokens.

Summary

if 10 ** (boostDecimals - collateralDecimals) > amount the address to gets IBoostStablecoin without any collateral

https://github.com/sherlock-audit/2024-10-axion/blob/main/liquidity-amo/contracts/Minter.sol#L77C5-L85C6

Root Cause

there is no check if 10 ** (boostDecimals - collateralDecimals) > amount

Internal pre-conditions

No response

External pre-conditions

1. 10 ** (boostDecimals - collateralDecimals) > amount
2. IERC20Upgradeable(collateralAddress) doesn't revert on 0 transfer

Attack Path

No response

Impact

the address to gets free IBoostStablecoin tokens.

PoC

No response

Mitigation

consider using a custom function to convert the amount between the tokens