# Incorrect decimal usage in score calculation leads to reduced user reward earnings

Venus Prime used vToken decimals (8) instead of underlying token decimals (18) when scaling capital, inflating scores and zeroing rewardIndex deltas so users earned no rewards.

- Payout: Contest reward
- Severity: high
- Program: Venus Protocol
- Credited: Brenzee
- Disclosed: 2023-11-29
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2023-09-venus-findings/issues/122
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-venus%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss vuln:reward-distribution

**Target:** Prime.sol _calculateScore / Scores.calculateScore reward accounting
**Root cause:** Prime._calculateScore scales capital by 10**(18 - vToken.decimals()) instead of underlying token decimals; vTokens are 8 decimals while underlying is 18, yielding 28-decimal capital instead of 18.
**Steps:**
1. Observe _capitalForScore returns capital in underlying token decimals (18).
2. Read Prime.sol L660-663: `capital = capital * (10 ** (18 - vToken.decimals()));` uses vToken decimals (8 on BSC).
3. Resulting capital has 28 decimals; Scores.calculateScore expects 18, inflating score and sumOfMembersScore.
4. In accrueInterest, `delta = (distributionIncome * EXP_SCALE) / sumOfMembersScore` truncates to 0.
5. Repro: set vToken decimals to 8 in tests, run `npx hardhat test tests/hardhat/Prime/*.ts`; tests fail.
6. PoC: issue prime to user, mint vBNB, mock PSR.getUnreleasedFunds=103683, call `prime.accrueInterest(vbnb)`; assert rewardIndex == 0.
**How found:** Code-reading of the score/reward pipeline: noticed _capitalForScore returns underlying-decimal capital, then the scaling line uses vToken.decimals(); cross-checked BSC vToken decimals (8) vs underlying (18) and confirmed tests masked it by setting vToken decimals to 18.
**Exploitation:** Not an attacker-driven exploit; the flaw silently prevents all Prime users from accruing rewards because rewardIndex never increments despite unreleased funds and nonzero sumOfMembersScore.
**Insight:** When a protocol mixes vToken and underlying token accounting, verify every decimal-scaling site uses the same token's decimals; also check whether test harnesses set unrealistic token decimals that hide precision bugs.