Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Protocol assumes all Chainlink USD price feeds use 8 decimals places

pacelli

Summary

The protocol could use as collateral any token that has a Chainlink USD price feed to query for prices, but it assumes all of them work with 8 decimals places, currently there are feeds like AMP/USD (Ethereum Mainnet) or SAVAX/USD (BNB Chain Mainnet) what work with 18 decimals places, if these price feeds were used then huge precision problems will occur.

Tools Used

Manual verification.

Recommendations

Don't assume the number of decimals for all the price feeds and instead dynamically add the precision required for each one.

DSCEngine::getUsdValue could be modified like this:

function getUsdValue(address token, uint256 amount) public view returns (uint256) {
AggregatorV3Interface priceFeed = AggregatorV3Interface(s_priceFeeds[token]);
(, int256 price,,,) = priceFeed.staleCheckLatestRoundData();
uint256 decimals = priceFeed.decimals();
uint256 extraPrecision = PRECISION - decimals;
return ((uint256(price) * BASE ** extraPrecision) * amount) / BASE ** PRECISION;
}

Where PRECISION = 18 and BASE = 10.

A similar setup could be implement for DSCEngine::getTokenAmountFromUsd.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.