Foundry DeFi Stablecoin CodeHawks Audit Contest

Summary

The getUsdValue function return a wrong value if the token's decimals is not 18

Vulnerability Details

The getUsdValue(address token, uint256 amount) function return a usd value with precision of 1e18.
the price's precision is 1e8. ADDITIONAL_FEED_PRECISION = 1e10, PRECISION = 1e18.
result is (uint256(price) * ADDITIONAL_FEED_PRECISION) * amount) / PRECISION
For the token with precision of 1e18 , the result is correct.
For one WBTC, amount = 1e8, assume price is 30000e8，the result is 3e12, means 0.0003

Impact

The getAccountCollateralValue function call the getUsdValue function. If the user have WBTC as collateral, the value of user's collateral is seriously underestimated。

Tools Used

Recommendations

//calculate the token's decimals for the result
function getUsdValue(address token, uint256 amount) public view returns (uint256) {
AggregatorV3Interface priceFeed = AggregatorV3Interface(s_priceFeeds[token]);
(, int256 price,,,) = priceFeed.staleCheckLatestRoundData();

    uint8 tokenDecimals = IERC20(token).decimals();
  
    return ((uint256(price) * ADDITIONAL_FEED_PRECISION) * amount) / (10**tokenDecimals);
}