Submission Details
Severity:
Recommendation to check decimals <= 18
Summary
Inside ChainlinkARBOracle.consultIn18Decimals I would recommend to check decimals returns from consult is <= 18
Vulnerability Details
ChainlinkARBOracle.consultIn18Decimals calls consult, converts the result to uint256 and then divides by 10 ** _decimals.
If _decimals is > 18, there is a chance that the output of consultIn18Decimals returns a 0.
Impact
Returns incorrect price
Tools Used
Recommendations
Check that _decimals is <= 18 or handle the 2 cases separately.
Check _decimals is <= 18
return _answer.toUint256() * (10 ** (18 - _decimals))
Handle separately
if (_decimals <= 18) {
return _answer.toUint256() * (10 ** (18 - _decimals));
} else {
return _answer.toUint256() / (10 ** (_decimals - 18));
}
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
2,28915
USDC / LOC
33,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.