# EthAssetManager and ThreePoolAssetManager don’t control Meta tokens decimals

Alchemix asset managers assume meta pool tokens have 18 decimals, so non-18-decimal tokens break mint slippage control, blocking mints or enabling fund loss.

- Payout: Audit contest
- Severity: medium
- Program: Alchemix
- Found by: hyh
- Disclosed: 2022-07-18
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2022-05-alchemix#m-06
- Library page: http://bugbountylibrary.com/r/c4%3A2022-05-alchemix%3AM-06
- Tags: area:web3 domain:web3 impact:dos impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** EthAssetManager and ThreePoolAssetManager meta pool minting
**Root cause:** Minting computes total as a plain sum of raw token amounts and derives minimumMintAmount from it, hard-coding an 18-decimal assumption for meta pool tokens whose decimals are not validated at construction.
**Steps:**
1. Note _metaPoolAssetCache is filled from params.metaPool.coins(i) with no decimals check in either constructor.
2. In _mintMetaPoolTokens, total += amounts[i] sums raw amounts across tokens.
3. expectedOutput = total * CURVE_PRECISION / metaPool.get_virtual_price(); minimumMintAmount = expectedOutput * metaPoolSlippage / SLIPPAGE_PRECISION.
4. Call metaPool.add_liquidity(amounts, minimumMintAmount) with a meta token whose decimals != 18.
5. Higher decimals: minimumMintAmount far exceeds achievable output, mint reverts. Lower decimals: minimumMintAmount too small, slippage control void.
**How found:** Code reading of the minting loop noticed raw amounts summed without decimal normalization, then cross-checked that constructors never validate meta token decimals, while calculateRebalance inconsistently queries alUSD decimals.
**Exploitation:** With a lower-decimal meta token, an attacker mints through the pool while the computed minimumMintAmount is negligible, accepting excess slippage and extracting value from the protocol's mint path.
**Insight:** When a contract caches pool coins at construction, check whether any downstream math assumes fixed decimals; inconsistent decimal handling between functions (here calculateRebalance reads decimals but minting doesn't) is a strong signal of a broken assumption.