Spotting issues in DeFi with dimensional analysis

Summary: Trail of Bits describes applying dimensional analysis, the physics practice of checking that both sides of an equation share the same dimensions, to catch logic and arithmetic bugs in DeFi formulas without code changes. The post cites a real vulnerability from its CAP Labs audit (TOB-CAP-17), where an ERC-4626 convertToAssets function received decimals instead of a number of assets, and notes that Solidity lacks the compile-time units-of-measure enforcement found in F#.
Bottom line: A units mismatch in a single function input was enough to produce a real finding in an audited codebase, and Solidity will not flag it for you. The post's proposed backstop, a Slither-based checker that infers and propagates units across a codebase, does not yet exist.

Read the original at Trail of Bits Blog ↗