Open Dollar - cryptothemex's results

Lines of code

https://github.com/open-dollar/od-contracts/blob/f4f0246bb26277249c1d5afe6201d4d9096e52e6/src/contracts/oracles/UniV3Relayer.sol#L64 https://github.com/open-dollar/od-contracts/blob/f4f0246bb26277249c1d5afe6201d4d9096e52e6/src/contracts/oracles/CamelotRelayer.sol#L58 https://github.com/open-dollar/od-contracts/blob/f4f0246bb26277249c1d5afe6201d4d9096e52e6/src/contracts/oracles/ChainlinkRelayer.sol#L42

Vulnerability details

Impact

Open Dollar contracts implement price feed oracles such as UniV3Relayer, CamelotRelayer with assumption that all _quoteToken tokens will have 18 or lesser decimals and returned price will then be converted to 18 decimals format correctly. However, many tokens such as YAM, NEAR has 24 decimals. Thus, UniV3Relayer, CamelotRelayer contracts will not be able to return 18 decimals format value for tokens with decimals greater than 18.

Proof of Concept

UniV3Relayer, CamelotRelayer computes a multiplier as following in line 64 and 58, respectively :-

multiplier = 18 - IERC20Metadata(_quoteToken).decimals();

if _quoteToken has decimals more than 18, then above statement will cause underflow and unexpected behavior of code.

Tools Used

Manual Review

Recommended Mitigation Steps

Include a check that sets multiplier to zero if _quoteToken has decimals more than 18.

Assessed type

Oracle