Core Contracts

Summary

Prices that comes from the response will be massively inflated due to the way the protocol modifies them in the chainlink function.

Vulnerability Details

Per sponsor's notes

NOTE: We do Math.pow(price, 18) to have 18 decimals as for crvUSD.

Let's say real estate costs 120k usd. Now the response will return 120_000^18 = ~2.7e91

This is larger than uint(256).max so the set will mostly always revert.

Impact

Prices can not be set

Tools Used

Manual review

Recommendations

Modify the price so it fits into crvUSD decimal amount(18)