In getRSETHPrice function the precision of total balance of assets isn't converted to 18 decimals, if an asset has less decimals it cause the returned price of RSETH become larger than expected.
the assetER has 18 decimals and also rsEthSupply has 18 decimals so if totalAssetAmt has different decimals the calculation for the price on line 78 will be wrong, for assets which has less than 18 decimals, makes the price become larger and for assets which has greater than 18 decimals the price will be smaller.
in this function you add different values with different decimals into totalETHInPool.
Proof of Concept
Imagine there is 2000 USDT (USDT has 6 decimals) in the pool and there is 1 RsETH as total supply
If we want to call getRSETHPrice with these values the formated version of this calculation will look like this:
assetER for USDT/ETH = 488704664632542
totalAssetAmt of USDT = 2000000000 (it has 6 decimals)
totalETHInPool = 2000000000 * 488704664632542 = 977409329265084000000000
rsEthSupply = 1000000000000000000
return 977409329265084000000000 / 1000000000000000000 = 977409
As you see the price will be 977409 which is too small
Tools Used
Manual review
Recommended Mitigation Steps
Consider scale precision of the totalAssetAmt into 18
Lines of code
https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTOracle.sol#L70-L71
Vulnerability details
Impact
In getRSETHPrice function the precision of total balance of assets isn't converted to 18 decimals, if an asset has less decimals it cause the returned price of RSETH become larger than expected.
the
assetER
has 18 decimals and alsorsEthSupply
has 18 decimals so iftotalAssetAmt
has different decimals the calculation for the price on line 78 will be wrong, for assets which has less than 18 decimals, makes the price become larger and for assets which has greater than 18 decimals the price will be smaller.in this function you add different values with different decimals into
totalETHInPool
.Proof of Concept
Imagine there is 2000 USDT (USDT has 6 decimals) in the pool and there is 1 RsETH as total supply
If we want to call
getRSETHPrice
with these values the formated version of this calculation will look like this:As you see the price will be
977409
which is too smallTools Used
Manual review
Recommended Mitigation Steps
Consider scale precision of the
totalAssetAmt
into 18Assessed type
Math