Assuming Chainlink price feed decimals is dangerous

Summary

The protocol assumes that the Chainlink price feed will always have 8 decimals, which is not necessarily the case, even when only using USD price feeds.

Vulnerability Details

LibOracle#getOraclePrice is used to fetch the price of an asset using Chainlink price feeds. During the process, the returned price value is assumed to have 8 decimals, and the value is multiplied by 10**10 to scale it up to 18 decimals precision:

The issue here is that the price feed may not have exactly 8 decimals. Despite most Chainlink USD feeds using 8 decimals, this is not guaranteed. For example, the AMPL/USD feed has 18 decimals, and there is no guarantee that USD price feeds added in the future would conform to the 8 decimal standard.

Impact

The price returned by LibOracle#getOraclePrice may be too large by 10 orders of magnitude depending on the asset, in which case the protocol would vastly overestimate the amount of collateral provided by a user, allowing them to mint up to 10**10 times as many stablecoins as they should be able to, severely affecting the collateralization and effectively stealing value from other stablecoin holders.

Tools Used

Manual review

Recommendations

Instead of using a constant BASE_ORACLE_DECIMALS, call decimals() on the oracle to ensure that the price is being scaled up appropriately.