DittoETH

Summary

Chainlink oracles can return prices with different decimal places, potentially resulting in incorrect price calculations.

Vulnerability Detail

In LibOracle.getOraclePrice, if the asset for which the price is being retrieved uses a different decimal place than the base oracle, the price will be calculated based on the base oracle's price and the asset's oracle price. The calculation is straightforward: oracle's price / base oracle's price. However, there is a possibility that both oracles have different decimal places, which could lead to incorrect price calculations.

Impact

Incorrect price calculations can result in financial losses for users.

Tool Used

Manual Review

Recommendation

To mitigate this issue, use AggregatorV3Interface.decimals() to ensure that both oracles have the same number of decimal places. This will help ensure accurate price calculations.