Open Dollar - 0xsurena's results

Lines of code

https://github.com/open-dollar/od-contracts/blob/f4f0246bb26277249c1d5afe6201d4d9096e52e6/src/contracts/oracles/CamelotRelayer.sol#L58

Vulnerability details

Impact

The CamelotRelayerFactory.sol contract can deploy CamelotRelayer.sol for pairs/pools that is deployed on the Camelot.

function deployCamelotRelayer(
address _baseToken,
address _quoteToken,
uint32 _quotePeriod
) external isAuthorized returns (IBaseOracle _camelotRelayer) {
_camelotRelayer = new CamelotRelayerChild(_baseToken, _quoteToken, _quotePeriod);
_camelotRelayers.add(address(_camelotRelayer));
emit NewCamelotRelayer(address(_camelotRelayer), _baseToken, _quoteToken, _quotePeriod);
}

In the CamelotRelayer.sol and constructor function, multiplier value is set by 18 - IERC20Metadata(_quoteToken).decimals(). Now if decimal of _quoteToken is more than 18, deployment of new CamelotRelayer.sol contract will get reverted.

Proof of Concept

https://github.com/open-dollar/od-contracts/blob/f4f0246bb26277249c1d5afe6201d4d9096e52e6/src/contracts/factories/CamelotRelayerFactory.sol#L28 https://github.com/open-dollar/od-contracts/blob/f4f0246bb26277249c1d5afe6201d4d9096e52e6/src/contracts/oracles/CamelotRelayer.sol#L58

Tools Used

Manually

Recommended Mitigation Steps

Calculate multiplier value based on the IERC20Metadata(_quoteToken).decimals() > 18 or IERC20Metadata(_quoteToken).decimals() < 18.

Assessed type

Decimal