8 decimal assumption for X/USD pair is wrong
Summary
Not all tokens have 8 decimals in the USD pair, example: https://etherscan.io/address/0xe20CA8D7546932360e37E9D72c1a47334af57706#readContract
Vulnerability Details
OracleLib::staleCheckLatestRoundData is returning a price which is assumed to have 8 decimals each time it is used in DSCEngine.
Impact
This will impact severely the price estimation of any underlying token with decimals different from the hard-coded 8. It will impact the health factor, resulting in loss of funds for the user or loss of abusive borrowing of DSC.
Tools Used
Manual
Recommendations
Use the .decimals() in the AggregatorV3Interface and make ADDITIONAL_FEED_PRECISION non constant, it should be 1e18 - feed.decimals()`.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.