You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The issue is that the assetPrice is provided as it is after being fetched from Chainlink. Chainlink feeds return prices in different decimals (most commonly 8 and 18) and there is no clear pattern as to how many decimals will a feed return:
Thus, for some assets, we will have a much larger or smaller value depending on the amount of decimals a Chainlink feed returns which will be used for important calculations such as the health factor of a user. A user might be unfairly liquidated or unfairly kept with a healthy position due to that. Note that the assetUnit input in the function are the decimals of the asset, not the decimals which Chainlink returns.
Impact
Not including Chainlink decimals upon calculations will lead to accounting issues
sherlock-admin3
changed the title
Acrobatic Rainbow Grasshopper - Not including Chainlink decimals upon calculations will lead to accounting issues
000000 - Not including Chainlink decimals upon calculations will lead to accounting issues
Oct 3, 2024
000000
High
Not including Chainlink decimals upon calculations will lead to accounting issues
Summary
Not including Chainlink decimals upon calculations will lead to accounting issues
Vulnerability Detail
Upon calculating prices in the base currency, we use
GenericLogic::_getUserDebtInBaseCurrency()
orGenericLogic::_getPositionBalanceInBaseCurrency()
:The issue is that the
assetPrice
is provided as it is after being fetched from Chainlink. Chainlink feeds return prices in different decimals (most commonly 8 and 18) and there is no clear pattern as to how many decimals will a feed return:Thus, for some assets, we will have a much larger or smaller value depending on the amount of decimals a Chainlink feed returns which will be used for important calculations such as the health factor of a user. A user might be unfairly liquidated or unfairly kept with a healthy position due to that. Note that the
assetUnit
input in the function are the decimals of the asset, not the decimals which Chainlink returns.Impact
Not including Chainlink decimals upon calculations will lead to accounting issues
Code Snippet
https://github.com/sherlock-audit/2024-06-new-scope/blob/c8300e73f4d751796daad3dadbae4d11072b3d79/zerolend-one/contracts/core/pool/logic/GenericLogic.sol#L184-L219
Tool used
Manual Review
Recommendation
Fetch the Chainlink decimals as well and include them in the calculation so that you always return the same amount of decimals
Duplicate of #166
The text was updated successfully, but these errors were encountered: