Not all tokens have 8 decimals in the USD pair, example: https://etherscan.io/address/0xe20CA8D7546932360e37E9D72c1a47334af57706#readContract
OracleLib::staleCheckLatestRoundData
is returning a price which is assumed to have 8 decimals each time it is used in DSCEngine
.
This will impact severely the price estimation of any underlying token with decimals different from the hard-coded 8. It will impact the health factor, resulting in loss of funds for the user or loss of abusive borrowing of DSC.
Manual
Use the .decimals()
in the AggregatorV3Interface
and make ADDITIONAL_FEED_PRECISION
non constant, it should be 1e18 - feed.decimals()`.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.