The Standard

Summary

Token decimals could be outdated since they are obtained from storage from a contract that does not update it's data once the data has been initialised.

Vulnerability Details

In LiquidationPool::distributeAssets, the token decimals are obtained via the struct TokenManager.Token and it's .dec field.

Once the TokenManager contract (which is out scope) has set the value of .dec for each asset, it can never be updated after that. (unless the entire asset manually removed and updated)

Impact

If chainlink changes the decimals() of that asset's price feed, this will not be reflected in the calculations done by LiquidationPool::distributeAssets, which would result in a critical error.

Recommended Mitigation

Ideally, it would be best practice to call AggregatorV3Interface(###).decimals() and use that value whenever using data obtained from a chainlink price feed.