# Yearn token <> shares conversion decimal issue

YearnYield converts Yearn shares to tokens dividing by fixed 1e18 instead of vault decimals, mispricing non-18-decimal underlying tokens.

- Payout: Audit contest
- Severity: high
- Program: Sublime
- Found by: cmichel
- Disclosed: 2022-02-14
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-12-sublime-findings/issues/134
- Library page: https://bugbountylibrary.com/r/c4%3A2021-12-sublime%3AH-04
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** Yearn yield strategy contract (getTokensForShares/getSharesForTokens)
**Root cause:** getPricePerFullShare is denominated in vault.decimals() (matching underlying token decimals), but the code divides by a hardcoded 1e18, so conversions are wrong for tokens not using 18 decimals.
**Steps:**
1. Read YearnYield.getTokensForShares: `amount = getPricePerFullShare().mul(shares).div(1e18)`
2. Note Yearn Vault.vy getPricePerFullShare returns value in vault.decimals() precision, and vault decimals equal underlying token decimals
3. For an underlying token with e.g. 6 decimals, dividing by 1e18 instead of 1e6 mis-scales the result by 1e12
4. Same flaw applies to getSharesForTokens
5. Fix: divide by `10**vault.decimals()`
**How found:** Code review of the YearnYield conversion math against Yearn's Vault.vy source, spotting the hardcoded 1e18 versus the vault-decimal-denominated pricePerFullShare.
**Insight:** When integrating Yearn (or any share-based vault), verify the denomination of pricePerFullShare/getPricePerShare against the vault's decimals rather than assuming 1e18; non-18-decimal underlyings (USDC, WBTC) silently mis-scale conversions.