# There are multiple issues with the decimal conversions between the vault and the strategy

StrategyLeverage mixes 18-decimal vault shares with native token decimals across deploy/undeploy/swap paths, breaking non-18-decimal tokens and mispricing withdrawals.

- Payout: Audit contest
- Severity: high
- Program: BakerFi
- Credited: shaflow2
- Disclosed: 2025-02-26
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-bakerfi-invitational#h-04
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-bakerfi-invitational%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** StrategyLeverage / StrategySupplyBase Solidity contracts
**Root cause:** Vault shares are fixed at 18 decimals while strategy functions (_deploy, _undeploy, _convertToCollateral/_convertToDebt, _adjustDebt, _payDebt) inconsistently pass native token decimals where 18-decimal values are expected and vice versa.
**Steps:**
1. Deploy vault with a non-18-decimal underlying token (e.g. USDC 6 decimals).
2. Call deposit: `_depositInternal` computes `shares = total.toBase(deployedAmount, false)` but `_deploy` returns native-decimal amount, so shares are miscomputed.
3. Call redeem: `withdrawAmount = shares * totalAssets() / totalSupply()` is 18-decimal, passed to `_undeploy` and packed into callback data.
4. `_withdraw` in StrategyLeverageAAVEv3/MorphoBlue uses the 18-decimal amount directly against native-decimal token, withdrawing wrong amount.
5. Observe `_convertToCollateral`/`_convertToDebt` receive native-decimal amount during deploy but oracle math expects 18-decimal, producing wrong `amountOutMinimum`.
6. `_adjustDebt` and `_payDebt` also fail to convert flash-loan/swap amounts between 18-decimal and token decimals.
**How found:** Code review of StrategyLeverage/StrategySupplyBase tracing decimal units across deposit, redeem, undeploy, swap and debt-adjustment paths against the 18-decimal share assumption.
**Exploitation:** Not a direct theft path; incorrect decimal handling causes mispriced share minting/burning and wrong withdraw/swap amounts for non-18-decimal tokens, leading to fund loss or broken accounting for users of such vaults.
**Insight:** When a vault fixes share decimals at 18 but the strategy holds native-decimal tokens, audit every boundary where amounts cross between share-space and token-space (deploy return, undeploy input, swap params, flash-loan amounts) for missing toBase/toDecimals conversions.