Fujicracy / fuji-v2

Cross-chain money market aggregator
https://fuji-v2-frontend.vercel.app
15 stars 10 forks source link

CS - FujiOracle lack of decimals verification #190

Closed 0xdcota closed 1 year ago

0xdcota commented 1 year ago

Where: https://github.com/Fujicracy/fuji-v2/blob/ab02d2308797577973ac358af8c7aadf973bcec7/packages/protocol/src/FujiOracle.sol#L30

Description: The price feed that is added to the oracle is assumed to have 8 decimals, but it is never verified.

Recommendation: Verify that price feed returns value 8 from decimals function.