Summary

The protocol assumes that all Chainlink's USD denomination returns 8 decimal places, but that is not the case for some pairs, like AMPL/USD which returns 18 decimal places instead.

Vulnerability Details

Whenever the protocol wants to calculate how much a user's position is worth in USD, the function getUsdValue() is called. In fact, this function is called every time the health factor is checked.

Looking closely at the getUsdValue() function, the price returned is always assumed to have 8 decimal places for all USD denominated pairs, that's why ADDITIONAL_FEED_PRECISION is multiplied to make it 1e18.

The protocol intends to work with all tokens that has a Chainlink USD pair.

This project is meant to be a stablecoin where users can deposit WETH and WBTC in exchange for a token that will be pegged to the USD. The system is meant to be such that someone could fork this codebase, swap out WETH & WBTC for any basket of assets they like, and the code would work the same.

However, not all USD-denominated pairs return 8 decimal places. For example, the AMPL/USD pair returns 18 decimal places. If AMPL is used as a collateral and getUsdPrice() is called, the price returned will be inflated by a 10 decimal places, which is a billion dollars. Users can completely break the protocol by depositing a small some of AMPL and minting millions of DSC, because one AMPL is erroneously worth 1 billion.

Reference: https://etherscan.io/address/0xe20ca8d7546932360e37e9d72c1a47334af57706#readContract

Impact

Protocol can be completely broken by position owners minted a huge amount of DSC stablecoins if AMPL/USD or any USD pair with more than 8 decimals is used.

Tools Used

Manual Review

Recommendations

Recommend either restricting the Aggregator Feeds Used (hardcoding or explicitly mentioning that only certain tokens will be used as collateral), or make sure that every aggregator feed uses the built in decimal function to check the decimal place of the returned price, instead of freely assuming that every USD pair returns 8 decimal places.