Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

`ChainlinkARBOracle.consultIn18Decimals` function returns wrong price if answer decimals is > 18

0xhals

Summary

ChainlinkARBOracle.consultIn18Decimals function returns wrong price if answer decimals is > 18

Vulnerability Details

  • The ChainlinkARBOracle.consultIn18Decimals function extracts the token price from a chainlink price feed and scales it to be retuned in 18 decimals.

  • But if the returned _decimals is > 18; this will result in scaling down the price and thus retruning a token price lower than the actual price.

Impact

ChainlinkARBOracle.consultIn18Decimals function will return lower token price if the returned _decimal > 18.

Proof of Concept

ChainlinkARBOracle.consultIn18Decimals function

function consultIn18Decimals(address token) external view whenNotPaused returns (uint256) {
(int256 _answer, uint8 _decimals) = consult(token);
​
return _answer.toUint256() * 1e18 / (10 ** _decimals);
}

Tools Used

Manual Review.

Recommendations

Update ChainlinkARBOracle.consultIn18Decimals function to handle prices _decimals > 18.

Updates

Lead Judging Commences

hans Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.