← All findings
low SHARE_COUNT_MISREAD_RISK

LRCX: reading balanceOf() as shares understates by 0.0732% (multiplier 1.000732563x)

read from LRCX (0x57b0030166DB0C31690d1A5aA167e2e26e2C29a4) · methodology assay-rh-v0.4.0 · detected 2026-10-08T03:57:21.000Z
from the sweep at block 83015737, 10m ago

Who carries the exposure

Any integrator that presents LRCX balanceOf() as a share count. The contract itself is behaving as ERC-8056 specifies and is not at fault.
The contract named above is what was READ. Naming it is not an accusation against it: a Stock Token that moves uiMultiplier() is doing what ERC-8056 specifies.

LRCX reports uiMultiplier() = 1000732562938505984 (1.000732563), which is CORRECT AND SPEC-COMPLIANT behaviour under ERC-8056 — this finding is not a defect in the token contract. It records the exposure carried by a caller that reads balanceOf() as shares. Under ERC-8056 a corporate action moves the multiplier rather than balances, so balanceOf() returns tokens and share-equivalents = balance * uiMultiplier() / 1e18. A surface presenting the raw balance as a share count understates it by 0.0732% (the true count is 1.0007x the raw balance). Token value computed as balance * Chainlink feed price is unaffected, because the feed is already multiplier-adjusted.

Impact

0.0732% · how far a raw balanceOf() read as shares understates the true share count, as a share of the true count
totalSupply raw 27.7002 tokens vs 27.7204 share-equivalents (delta 0.0202). Presenting the raw balance as a share count understates by 0.0732%; equivalently the true count is 1.0007x the raw.

Evidence — 2/2 citations re-fetched and byte-compared

mismatched 0 · pruned 0 · verified 2026-10-08T03:57:26.503Z
uiMultiplier() == 1000732562938505984
chain 4663 · block 83016238 · uiMultiplier()
0x57b0030166DB0C31690d1A5aA167e2e26e2C29a4
0x0000000000000000000000000000000000000000000000000de350f6c11dab00
totalSupply() == 27700207850000000000
chain 4663 · block 83016238 · totalSupply()
0x57b0030166DB0C31690d1A5aA167e2e26e2C29a4
0x000000000000000000000000000000000000000000000001806ae8470fbca400

Right of reply

No reply has been received for this finding. Anyone named here can have a response published verbatim and unedited alongside it. A finding shown to be wrong is corrected by changing the rule that produced it, with the notice recorded in the repository. Open a right-of-reply issue or see docs/RIGHT-OF-REPLY.md. Pre-publication notice is deliberately not claimed: the sweep publishes on a timer and for most findings the subject is a contract, not a person to notify.
LRCX: reading balanceOf() as shares understates by 0.0732% (multiplier 1.000732563x) · ASSAY