Summary

The normalizationFactor is calculated as 18 - priceFeed.decimals(). This assumes that the Chainlink oracle will always have decimals less than or equal to 18. If this assumption changes in the future, the calculation could be incorrect.

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/ChainlinkOracle.sol#L21

Vulnerability Details

The vulnerability lies in the unsigned arithmetic operation used to calculate the normalization factor. In Solidity, when priceFeed.decimals() returns a value greater than 18, the subtraction will result in arithmetic underflow, leading to an extremely large normalization factor.

For example:

• If priceFeed.decimals() returns 19, the calculation becomes: 18 - 19

• Due to unsigned arithmetic, this underflows to: 2^256 - 1

• This incorrect normalization factor is then used in subsequent price calculations

Impact

Incorrect price calculations leading to mispriced assets

• Wrong liquidation triggers

• Inaccurate collateral calculations

• Trading losses due to incorrect price information

1. Alice is a developer who deploys the ChainlinkOracle contract with a Chainlink oracle that returns decimals greater than 18.

2. Bob is an end-user who relies on the data provided by Alice's contract for price feeds.

Exploit:

Due to the incorrect normalization factor calculation, the data provided by the contract is incorrect. Bob receives erroneous price data, which could lead to financial losses if he makes decisions based on this data.

Tools Used

manual

Recommendations