Description

The swap calculation in MantleTokenMigrator is done using _tokenSwapCalculation (as shown below). This function uses TOKEN_CONVERSION_NUMERATOR and TOKEN_CONVERSION_DENOMINATOR variables declared in the constructor.

function _tokenSwapCalculation(uint256 _amount) internal view returns (uint256) {
    return (_amount * TOKEN_CONVERSION_NUMERATOR) / TOKEN_CONVERSION_DENOMINATOR;
}

If the TOKEN_CONVERSION_NUMERATOR and TOKEN_CONVERSION_DENOMINATOR values differ in large order of magnitude, the _tokenSwapCalculation would return a lesser value. This might transfer less tokens to a user than they expect in the _migrateTokens functions as shown below:

function _migrateTokens(uint256 _amount) internal {
    if (_amount == 0) revert MantleTokenMigrator_ZeroSwap();

    uint256 amountToSwap = _tokenSwapCalculation(_amount);

    // transfer user's BIT tokens to this contract
    ERC20(BIT_TOKEN_ADDRESS).safeTransferFrom(msg.sender, address(this), _amount);

    // transfer MNT tokens to user, if there are insufficient tokens, in the contract this will revert
    ERC20(MNT_TOKEN_ADDRESS).safeTransfer(msg.sender, amountToSwap);

    emit TokensMigrated(msg.sender, _amount, amountToSwap);
}

Impact

A user might receive less tokens than they expect.

Recommendations

The values TOKEN_CONVERSION_NUMERATOR and TOKEN_CONVERSION_DENOMINATOR should be carefully set so the above calculations do not affect the tokens transferred to a user.

Remediation

This issue has been acknowledged by Mantle Network, and a fix was implemented in commit eced8f7f↗.