Protocol suppose that all of the price feeds have 8 decimals in chainlink
Summary
The protocol assumes that all Chainlink price feeds mapping a coin to USD have exactly 8 decimals, but this is not always the case. For example, the PEPE price feed on Arbitrum has 18 decimals, which could lead to incorrect price calculations.
Currently, all supported tokens have 8-decimal price feeds, so the issue does not immediately impact the protocol. However, as new tokens with different decimal configurations are added, this assumption may cause calculation errors or incorrect asset valuations.
Vulnerability Details
The system expects all price feeds to have 8 decimals, leading to miscalculations if a feed has a different decimal count.
Impact
Incorrect Pricing: The system may misinterpret price feed data, leading to incorrect token valuations.
Tools Used
Manual Review
Recommendations
Fetch Decimals Dynamically: Retrieve the correct decimal count using Chainlink’s decimals() function instead of assuming it is always 8.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.