# Lines of code https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Oracle.sol#L304-L305 # Vulnerability details ## Impact `V3Oracle._getReferenceTokenPriceX96` reverts, not able to return a price ## Proof of Concept `chainlinkPriceX96` is calculated by the following code. ```solidity chainlinkPriceX96 = (10 ** referenceTokenDecimals) * chainlinkPriceX96 * Q96 / chainlinkReferencePriceX96 / (10 ** feedConfig.tokenDecimals); ``` The numerator can overflow when reference token has 18 decimals. Math ``` 10 ** 18 * chainlinkPriceX96 * Q96 <= 2**256 10 ** 18 * chain link price * Q96 * Q96 <= 2**256 10 ** 18 * chain link price <= 2**(256 - 2 * 96) chain link price <= 2 ** 64 / 10 ** 18 <= 19 ``` This shows that if reference token has 18 decimals, the price oracle can only return a price if the token price is <= 19 Second test fails. It uses DAI (which has 18 decimals) as a reference token ```solidity // SPDX-License-Identifier: MIT pragma solidity 0.8.20; import {Test, console} from "forge-std/Test.sol"; // forge test --fork-url $FORK_URL --match-path test/dev.sol -vvv contract V3OracleTest is Test { uint256 constant Q96 = 2 ** 96; address constant USDC = 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48; address constant DAI = 0x6B175474E89094C44Da98b954EedeAC495271d0F; address constant WETH = 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2; address constant CHAINLINK_USDC_USD = 0x8fFfFfd4AfB6115b954Bd326cbe7B4BA576818f6; address constant CHAINLINK_DAI_USD = 0xAed0c38402a5d19df6E4c03F4E2DceD6e29c1ee9; address constant CHAINLINK_ETH_USD = 0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419; mapping(address => address) private feeds; function setUp() public { feeds[USDC] = CHAINLINK_USDC_USD; feeds[DAI] = CHAINLINK_DAI_USD; feeds[WETH] = CHAINLINK_ETH_USD; } function test() public { uint256 price = get(WETH, 18, USDC, 6); console.log("price", price); } function testFail() public { // price overflows uint256 price = get(WETH, 18, DAI, 18); console.log("price", price); } function get( address token, uint256 tokenDecimals, address referenceToken, uint256 referenceTokenDecimals ) public view returns (uint256) { uint256 chainlinkPriceX96 = _getChainlinkPriceX96(token, referenceToken); uint256 chainlinkReferencePriceX96 = _getChainlinkPriceX96(referenceToken, referenceToken); // console.log("chainlink price", chainlinkPriceX96 / Q96); // console.log("ref price", chainlinkReferencePriceX96 / Q96); // 10 ** 18 * chain link price * Q96 * Q96 <= 2**256 // 10 ** 18 * chain link price <= 2**(256 - 2 * 96) // chain link price <= 2 ** 64 / 10 ** 18 <= 19 chainlinkPriceX96 = (10 ** referenceTokenDecimals) * chainlinkPriceX96 * Q96 / chainlinkReferencePriceX96 / (10 ** tokenDecimals); return chainlinkPriceX96; } function _getChainlinkPriceX96(address token, address referenceToken) internal view returns (uint256) { if (token == referenceToken) { return Q96; } (, int256 answer,, uint256 updatedAt,) = AggregatorV3Interface(feeds[token]).latestRoundData(); require(answer >= 0, "answer < 0"); // ETH, USDC, DAI all have 8 decimals return uint256(answer) * Q96 / (10 ** 8); } } interface AggregatorV3Interface { function latestRoundData() external view returns ( uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound ); function decimals() external view returns (uint8); } ``` ## Tools Used Manual review, Foundry, python ## Recommended Mitigation Steps Rearrange multiplications and divisions. This will make the price less accurate. ```solidity if (referenceTokenDecimals >= tokenDecimals) { chainlinkPriceX96 = chainlinkPriceX96 * Q96 / chainlinkReferencePriceX96 * (10 ** (referenceTokenDecimals - tokenDecimals)) } else { chainlinkPriceX96 = chainlinkPriceX96 * Q96 / chainlinkReferencePriceX96 / (10 ** (tokenDecimals - referenceTokenDecimals)) } ``` ## Assessed type Math


Code4rena	Revert Lend	Revert	04/03/2024	15/03/2024	11 days	$88,500 in USDC	32/105	$422.35	3	0	2	-	Completed
Code4rena	Taiko	Taiko	04/03/2024	25/03/2024	21 days	$140,000 in USDC	12/69	$2,037.77	2	1	0	-	Completed
Code4rena	Panoptic	Panoptic	27/11/2023	04/12/2023	7 days	$60,500 USDC	69/72	$11.32	1	0	0	-	Completed

t4sk