Closed sherlock-admin closed 1 year ago
Chom
medium
TradingModule getOraclePrice is not supporting decimals != 18
answer = (basePrice * quoteDecimals * RATE_DECIMALS) / (quotePrice * baseDecimals); decimals = RATE_DECIMALS;
RATE_DECIMALS is fixed to 18
getOraclePrice is not supporting token with decimals != 18
https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/trading/TradingModule.sol#L228-L231
Manual Review
it should use baseOracle.rateDecimals instead of RATE_DECIMALS
answer = (basePrice * quoteDecimals * baseOracle.rateDecimals) / (quotePrice * baseDecimals); decimals = baseOracle.rateDecimals;
This looks like a valid issue
@Evert0x, sorry I misread the issue. This is in fact invalid. The trading module always scales exchange rates to 1e18 regardless of token decimals.
Chom
medium
TradingModule getOraclePrice is not supporting token with decimals != 18
Summary
TradingModule getOraclePrice is not supporting decimals != 18
Vulnerability Detail
RATE_DECIMALS is fixed to 18
Impact
getOraclePrice is not supporting token with decimals != 18
Code Snippet
https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/trading/TradingModule.sol#L228-L231
Tool used
Manual Review
Recommendation
it should use baseOracle.rateDecimals instead of RATE_DECIMALS