Open Dollar - 0xWaitress's results

Lines of code

https://github.com/open-dollar/od-contracts/blob/dev/src/contracts/oracles/CamelotRelayer.sol#L58

Vulnerability details

Impact

Camelot Relayer does not work with pairs with a quoteToken of decimal > 18

On Camelot Relayer, its constructor uses a variable multiplier which store the decimal multiplier to uniform result of quote tokens over base token ratio to 1e18.

  constructor(address _baseToken, address _quoteToken, uint32 _quotePeriod) {
    // camelotPair = ICamelotFactory(_CAMELOT_FACTORY).getPair(_baseToken, _quoteToken);
    camelotPair = IAlgebraFactory(_CAMELOT_FACTORY).poolByPair(_baseToken, _quoteToken);
    if (camelotPair == address(0)) revert CamelotRelayer_InvalidPool();

    address _token0 = ICamelotPair(camelotPair).token0();
    address _token1 = ICamelotPair(camelotPair).token1();

    // The factory validates that both token0 and token1 are desired baseToken and quoteTokens
    if (_token0 == _baseToken) {
      baseToken = _token0;
      quoteToken = _token1;
    } else {
      baseToken = _token1;
      quoteToken = _token0;
    }

    baseAmount = uint128(10 ** IERC20Metadata(_baseToken).decimals());
    multiplier = 18 - IERC20Metadata(_quoteToken).decimals();

Impact: if the dicimal of quoteToken is more than 18 the constructor would simply revert.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

Recommended Mitigation Steps

Consider handling tokens with decimal more than 18 for example using ray maths.

Assessed type

Math