Immense Hazel Copperhead - maxTokenAmountPerUser limit can be bypassed when currency token has less decimals than the launch token.

[sherlock-admin2]

Immense Hazel Copperhead

High

maxTokenAmountPerUser limit can be bypassed when currency token has less decimals than the launch token.

Summary

Due to the incorrect comparison in the function updateParticipation, an attacker can bypass the maxTokenAmountPerUser limit, allowing them to allocate more tokens than allowed.

Root Cause

The updateParticipation function in the Launch.sol contract contains a critical vulnerability due to the incorrect comparison of userTokenAmount and additionalCurrencyAmount (and refundCurrencyAmount). This comparison can lead to incorrect calculations when the payment currency and the token have different decimal places. For example, USDC has 6 decimals, while a LaunchToken might have 18 decimals. Adding these values directly without proper normalization can result in incorrect calculations, allowing an attacker to allocate more tokens than the maxTokenAmountPerUser.

https://github.com/sherlock-audit/2025-02-rova/blob/main/rova-contracts/src/Launch.sol#L355-L368

Internal Pre-conditions

Using tokens with less decimals than the token being launched.

External Pre-conditions

Attacker needs to pass checks for the launch before being able to participate.

Attack Path

An attacker can exploit this vulnerability by:

1. Initiating a participation with a small amount of tokens.
2. Using the updateParticipation function to bypass the maxTokenAmountPerUser check due to the issue described above.

Impact

An attacker can bypass the maxTokenAmountPerUser limit, allowing them to allocate more tokens than allowed. This can lead to an unfair distribution of tokens and financial loss for other participants.

PoC

No response

Mitigation

Do the comparisons with request.tokenAmount .