Chainlink's price feed responses could be expressed using different scales (such as 18 decimals or 8 decimals). The protocol is assuming that every collateral's price feed are using 18 decimals, which is risky.
This is not a big issue since the protocol was created with WBTC and WETH in mind as the valid collaterals. But there is no restrictions in the code blocking any other kind of collateral.
The use of a wrong decimals number could result in wrong health checks and undercollateralization of the protocol
Manual Review
Call AggregatorV3Interface.decimals()
to get the valid amount of decimals for every collateral and use it to scale the collateral usd amount properly
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.