Canto Dex Oracle contest - hake's results

Lines of code

https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L531-L532

Vulnerability details

Impact and Proof of Concept

Relying on decimals() might lead some tokens not being able to have their price converted because decimals() is not a mandatory and is absent from many ERC20 tokens.

https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L531-L532

        uint decimals = 10 ** token.decimals(); // get decimals of token

https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L543-L544

        uint decimals = 10 ** token.decimals();

https://github.com/code-423n4/2022-09-canto/blob/65fbb8b9de22cf8f8f3d742b38b4be41ee35c468/src/Swap/BaseV1-periphery.sol#L560-L577

decimals = 10 ** (erc20(token1).decimals()); // we must normalize the price of token1 to 18 decimals
                prices = pair.sample(token1, decimals, 8, 1);
                (unitReserves, assetReserves) = pair.sampleReserves(8, 1);
            } else {
                decimals = 10 ** (erc20(token0).decimals());
                prices = pair.sample(token0, decimals, 8, 1);
                (assetReserves, unitReserves) = pair.sampleReserves(8, 1);
            }
        } else { // non-stable pairs will be priced in terms of Canto
            if (token0 == address(wcanto)) { // token0 is Canto, and the unit asset of this pair is Canto
                decimals = 10 ** (erc20(token1).decimals());
                prices = pair.sample(token1, decimals, 8, 1);
                (unitReserves, assetReserves) = pair.sampleReserves(8, 1);
            } else {
                decimals = 10 ** (erc20(token0)).decimals();
                prices = pair.sample(token0, decimals, 8, 1);
                (assetReserves, unitReserves) = pair.sampleReserves(8, 1);
            }

Recommended Mitigation Steps

Either: Do not rely on decimals() for all tokens. Make sure all tokens being interacted with have decimals() implemented.