getUsdValue function in DSCEngine.sol Contract Is Not Accurate for All Tokens
Summary
The function getUsdValue in the DSCEngine.sol contract is calculating the price of USD based WETH/WTBC decimals. However, the function does not take into account the decimals of some tokens like USDC or any token supported by chainlink that has less then 18 decimals. This means that the function will give a wrong price if a different token is used, such as USDC.
Vulnerability Details
When user Redeem Collateral he might receive less then expected
Impact
The function getUsdValue in the DSCEngine.sol contract could give users a wrong price for USDC. This could lead to users making bad financial decisions or losing money.
Tools Used
Manual Review
Recommendations
The getUsdValue function should be used with caution. Users should be aware that the function may not be accurate for all tokens.
Do not Hardcode it
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.