Submitted by pauliax
The FixedStablecoins constructor does not validate that addresses in the array are not empty, != address(0), and instead relies on the creator passing the correct values for decimals. The comment next to USDC (0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48) says that it is supposed to have 6 decimals:
However, when querying the actual value on Etherscan, it shows 0 decimals:  The problem with USDC is that it uses a proxy pattern, thus the implementation could change (decimals could change but in practice, I think it is very unlikely).
I think it would be better not to pass decimals separately and, instead of relying on the correctness of the input, recommend using IERC20Detailed to query the decimals in code. Always querying the decimals on the go may be very inefficient and bring new attack vectors so I think you need to do here an assumption that decimals of upgradeable tokens wont change.
kristian-gro (Gro) acknowledged:
