Liquidity Management

Summary

The KeeperProxy contract's _check() function makes an unsafe assumption that all Chainlink price feeds have 8 decimal places. This assumption is incorrect as Chainlink price feeds have different decimal depending on the asset and feed configuration.

assuming oracle price precision is an ERROR :- Example Example2 & More

BTC / ETH & LINK / ETH , on arbitrum have 18 decimals

since it is hardcoded it is not extensible, if in future more price feeds are added, other than 8 decimals

Vulnerability Details

In the _check function: Check Function

• The function hardcodes an assumption that Chainlink price feeds use 8 decimals.

• However, Chainlink price feeds on arbitrum vary in precision. For example:

  ETH / USD → 8 decimals ✅ (assumption holds)\

  BTC / ETH → 18 decimals ❌ (assumption fails)

BTC / ETH feed uses 18 decimals, leading the division to result in an incorrectly scaled price.

Impact

• Incorrect price validations

• Wrong price comparisons

• System malfunction with price feeds that don't use 8 decimals

Tools Used

Manual Review

Recommendations

Query the price feed's decimals instead of assuming 8