Token Decimals

Token Decimals Explained in Detail

ERC-20 balances are raw integers. The decimals() value tells interfaces and integrations how to interpret those integers for display and scaling.

Decimals do not change the on-chain balance format. A token with 6 decimals and a token with 18 decimals both store balances as integers, but the same raw number represents different human-readable amounts.

Smart contract example

uint256 normalized = amount * 1e18 / (10 ** tokenDecimals);

This kind of normalization can be necessary, but it is also a common source of precision loss, overflow risk, and oracle scale mismatches.

Token Decimals in Auditing

Many DeFi bugs come from treating every asset as if it has 18 decimals. Stablecoins often use 6 decimals, some tokens use 8, and some integrations cannot assume that metadata behaves perfectly.

Auditors check token decimals together with oracle decimals, share decimals, fixed-point math, collateral factors, liquidation thresholds, and fee calculations.

Red flags in code

• 1e18 is hardcoded for every token amount.

• Token decimals and oracle decimals are mixed in one formula without clear normalization.

• The code assumes decimals() exists, never reverts, and never changes.

• Amounts from different assets are compared before scaling to a common unit.

• Decimal conversion happens after division instead of before it.

How to test or review it

• Test supported assets with 6, 8, 18, and unusual decimal values.

• Check whether each external token is allowlisted and configured explicitly.

• Review every conversion between token units, oracle units, and internal accounting units.

• Fuzz decimal settings in protocol-level tests when the asset list is configurable.

• Pair decimal tests with rounding error and liquidation boundary tests.