search

Kamino-Finance / scope

Scope is an oracle aggregator
Apache License 2.0
8 stars 7 forks source link

Assumption of Equal Token Decimals in jito_restaking.rs #10

Open oselezi opened 23 hours ago

oselezi commented 23 hours ago

The code assumes that both tokens involved in the price calculation (e.g., JitoSOL and VRT tokens) have the same number of decimals. This may not always be the case, leading to incorrect price calculations.

Details: In the get_price_int function, calculations are performed without adjusting for differences in token decimals. Token decimals are crucial when performing arithmetic operations involving token amounts.

Potential Risks: Incorrect price data can propagate through the protocol, affecting users and dependent calculations. It may lead to financial discrepancies or be exploited by malicious actors.

oselezi commented 23 hours ago

I think updating get_price function to accept vrt_mint_info and jito_sol_mint_info as parameters and adjust the amount based on decimals inside get_price_int function would be required to resolve the issue.