Vulnerability Details

This contract assumes that the decimal of erc20 tokens used as collateral is 18 decimal and their pricefeed’s decimal is 8, setting PRECISION and ADDITIONAL_FEED_PRECISION to 18 and 10, respectively.

However, if the assumption is broken, getUsdValue and getTokenAmountFromUsd could result in an incorrect calculation.

It is known that the decimal of chainlink’s pricefeed is 8 for USD-pair and 18 for ETH-pair. Additionally, the decimal of erc20 token would be not 18 such as USDC and USDT, which have 6 decimal.

Users could easily verify fake tokens and fake priceFeed getting their addresses by getter function. So this could be difficult to be regarded as a vulnerability.

But it is important.

Impact

If this occurs, the value of user's fund could be amplified or degraded.

Tools Used

manual

Recommendations

Either use a method to verify the collateral token’s decimal so that the above assumptions are maintained, or a way to get decimal information from a getter and store or use it without using constants.