Inverse Finance contest - cryptphi's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol#L53 https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol#L87-L88 https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol#L121-L122 https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L396 https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L462 https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L567

Vulnerability details

Impact

In an event where the Oracle contract operator sets the feed tokenDecimals value to 36 in Oracle.setFeed() , the call to Oracle.viewPrice would always return the non-scaled value of token price if feedDecimals is 0, since uint8 decimals = 36 - feedDecimals - tokenDecimals; in Oracle.getPrice() and Oracle.viewPrice() will output the value 0 , and uint normalizedPrice = price * (10 ** decimals); == feeds[token].feed.latestAnswer()

Due to this the following functions would revert since they will not be able to pass the require() checks; Market.borrowInternal() - https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L396 Market.withdrawInternal() - https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L462 Market.forceReplenish() - https://github.com/code-423n4/2022-10-inverse/blob/main/src/Market.sol#L567

Tools Used

Manual review

Recommended Mitigation Steps

Apply some value checks when setting the tokenDecimals for the token.