# Insufficient support for tokens with different decimals on different chains lead to loss of funds on cross-chain bridging

Axelar's InterchainTokenService relays unscaled token amounts, so bridging tokens with differing decimals across chains miscalculates amounts by 10^decimal-diff, causing fund loss.

- Payout: Contest reward
- Severity: medium
- Program: Axelar Network
- Credited: 0xTheC0der
- Disclosed: 2023-11-29
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-axelar-findings/issues/52
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-axelar%3AM-08
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** InterchainTokenService / TokenManager cross-chain token bridging
**Root cause:** TokenManager.sendToken and InterchainTokenService.transmitSendToken build the remote payload with the raw source amount, never scaling by the difference between source and remote token decimals; StandardizedToken can also be registered with same TokenId but different decimals per chain.
**Steps:**
1. Deploy/register StandardizedToken with 18 decimals on source chain and 16 decimals on remote chains via deployAndRegisterRemoteStandardizedToken.
2. Call `token.approve(tokenManager, amountSrc)` with amountSrc = 1234e18.
3. Call `tokenManager.sendToken(destChain, destAddress, amountSrc, '0x', {value: gasValue})`.
4. Observe emitted `ContractCall`/`TokenSent` payload contains unscaled amountSrc.
5. Relay payload via `gateway.approveContractCall(...)` on remote chain; remote token mints/transfers amountSrc interpreted at 16 decimals, off by 100x.
**How found:** Code-reading of the sendToken/transmitSendToken payload construction and noticing the amount is passed through without decimal normalization, then confirming StandardizedToken registration permits differing decimals per chain.
**Exploitation:** A deployer registers a StandardizedToken with mismatched decimals across chains; users bridging receive amounts off by 10^abs(decimal diff), letting a malicious deployer or pool drain value by bridging in one direction and back.
**Insight:** When auditing cross-chain bridges, check whether token amounts are normalized to a canonical decimal before being placed in the relayed payload; also check whether token registration enforces identical decimals across chains for the same token identity.