Submission Details
Severity:
Incorrect calculation of collateral value
Summary
Incorrect calculation of collateral value.
Vulnerability Details
Collateral value is calculated as below:
function getUsdValue(address token, uint256 amount) public view returns (uint256) {
AggregatorV3Interface priceFeed = AggregatorV3Interface(s_priceFeeds[token]);
(, int256 price,,,) = priceFeed.staleCheckLatestRoundData();
// 1 ETH = $1000
// The returned value from CL will be 1000 * 1e8
return ((uint256(price) * ADDITIONAL_FEED_PRECISION) * amount) / PRECISION;
}
Unfortunately, if collateral has more/less decimals than 18, the calculation would be wrong.
(1) Decimals more than 18
Decimals: 30
Price: 1e8
Amount: 1e30
Expected Value: 1e18
Calculated Value: 1e30
(2) Decimals less than 18
Decimals: 6
Price: 1e8
Amount: 1e6
Expected Value: 1e18
Calculated Value: 1e6
Impact
Collateral value is not calculated correctly.
Tools Used
Manual Review
Recommendations
PRECISION should be collateral's decimals.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
23664 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.