15,000 USDC
View results
Submission Details
Severity: medium
Valid

8 decimal assumption for X/USD pair is wrong

Summary

Not all tokens have 8 decimals in the USD pair, example: https://etherscan.io/address/0xe20CA8D7546932360e37E9D72c1a47334af57706#readContract

Vulnerability Details

OracleLib::staleCheckLatestRoundData is returning a price which is assumed to have 8 decimals each time it is used in DSCEngine.

Impact

This will impact severely the price estimation of any underlying token with decimals different from the hard-coded 8. It will impact the health factor, resulting in loss of funds for the user or loss of abusive borrowing of DSC.

Tools Used

Manual

Recommendations

Use the .decimals() in the AggregatorV3Interface and make ADDITIONAL_FEED_PRECISION non constant, it should be 1e18 - feed.decimals()`.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.