makerdao / univ2-lp-oracle

GNU Affero General Public License v3.0
23 stars 13 forks source link

Potential Price Overflow #25

Open hexonaut opened 3 years ago

hexonaut commented 3 years ago

There are a couple of places where the Oracle price can bump up against an upper bound. First and foremost we are restricted to a price of at most ~10^15 due to storing the price as a uint112 in the Feed. This should probably be increased as we already have a UNI LP that is getting close to this (WBTC-ETH). It is currently priced at ~10^9, and if we were to onboard an LP where the underlying token has even less decimals then we may run into this limit.

Beyond the uint112, https://github.com/makerdao/dss/blob/master/src/spot.sol#L98 restricts the upper bound on a reported oracle price to ~10^23. I suggest we both increase the precision of the Feed as well as add a test to make sure we do not add any oracles beyond 10^14 in price which gives us 9 orders of magnitude buffer.