Closed sherlock-admin2 closed 4 months ago
1 comment(s) were left on this issue during the judging contest.
panprog commented:
low, can be considered trusted admin action, and admin can easily do the conversion using the correct payoff function
@panprog Could you point me to where could the admin potentially convert this?
@nevillehuang Each oracle has payoff function connected with it, which is applied to price returned by oracle:
So the price can be fixed by using the payoff which multiplies the price by 10**10. It's not optimal, yes, but I'm not sure it's severe enough for the medium as there is simply no impact. Even if the price is not fixed via payoff, the price will consistently be just in different decimals, meaning users can't lose funds due to this, although it can be unexpected. Then again, admin has all the tools to fix the decimals issue via payoff function.
@panprog The price seems to be multiplied by itself, so wouldn't that be 10 8 decimals multiplied by each other twice? Are you indicating the admin would inject 10 10 into the payOff
associated with the oracle?
CC: @bin2chen66 @kbrizzle @arjun-io
@panprog The price seems to be multiplied by itself, so wouldn't that be 10 8 decimals multiplied by each other twice? Are you indicating the admin would inject 10 10 into the
payOff
associated with the oracle?
Payoff can be anything, it's just that example payoff is square and sqrt, but it can easily change decimals instead of being power of price, or it can be both.
@panprog I am unsure if such a fix would constitute this issue being invalid. @kbrizzle @arjun-io Would the workaround mentioned above affect the protocol in anyway?
We need to double check here, as the documentations we have from Chainlink (as well the feeds noted here: https://docs.chain.link/data-streams/stream-ids?network=arbitrum&page=1) list 18 decimals.
@arjun-io @bin2chen66 Seems like there is no issue here if the above comment is true. Is it also true for Base network as well?
Edit: Seems like there is no USDC/USD oracle on base chain as of yet as seen here, so this issue seems invalid
@nevillehuang OK.agree.thanks
bin2chen
medium
ChainlinkFactory no convert decimals
Summary
ChainlinkFactory._parsePrices ()
parsingverifiedReports
returns 8 decimals and is not converted to 18 decimalsVulnerability Details
ChainlinkFactory._parsePrices ()
parses theverifiedReports
, the code as follows:However, according to the chainlink documentation, the format of verifiedReports is as follows:
https://docs.chain.link/data-streams/reference/interfaces
price
is 8 decimal, not 18 decimalUFixed18
and the
price
isint192
notuint192
. In extreme cases, there may be a price of< 0
Impact
The wrong price unit may cause abnormal market calculations or an error in the
MultiInvoker
's order price trigger conditionCode Snippet
https://github.com/sherlock-audit/2024-02-perennial-v2-3/blob/main/perennial-v2/packages/perennial-oracle/contracts/chainlink/ChainlinkFactory.sol#L60
Tool used
Manual Review
Recommendation
check that the price cannot be less than 0