Skip to content

Latest commit

 

History

History
33 lines (18 loc) · 1022 Bytes

055.md

File metadata and controls

33 lines (18 loc) · 1022 Bytes

0xeix

high

Improper decimals handling in StableOracleDAI.sol

Summary

In StableOracleDAI.sol, the DAI/ETH price feed has 18 decimals but, instead, the contract makes all the calculations like it has 8 decimals.

Vulnerability Detail

Unlike BTC/USD or ETH/USD price feeds, all the ETH price feeds (DAI/ETH included) have 18 decimals instead of 8. Therefore, there is no need to multiply price by 1e10 like it's done in the contract.

Impact

High-risk vulnerability. Incorrect prices for getPriceUSD() will be received due to incorrect calculations for DAI/ETH price feed.

Code Snippet

uint256(price) * 1e10 : https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleDAI.sol#L52

Also, you can see the number of decimals for DAI/ETH price feed by reading the contract's variable on etherscan: https://etherscan.io/address/0x773616E4d11A78F511299002da57A0a94577F1f4#readContract

Tool used

Manual Review

Recommendation

Remove multiplication by 1e10.