ast3ros - Incorrect decimal of the DAI/ETH price feed

[sherlock-admin]

ast3ros

medium

Incorrect decimal of the DAI/ETH price feed

Summary

The return value of the DAI/ETH price feed has 18 decimals. However, it is treated as 8 decimals.

Vulnerability Detail

The price feed of DAI/ETH is obtained from the contract: 0x773616E4d11A78F511299002da57A0a94577F1f4. The decimal of the return value is 18.

    (, int256 price, , , ) = priceFeedDAIETH.latestRoundData();

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleDAI.sol#L48

However, when calculating the price in USD of DAI, it was incorrectly scaled up by 1e10 (it incorrectly assumes that the decimal is 8). This leads to a wrong price of DAI.

    ((DAIWethPrice + uint256(price) * 1e10) / 2);

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleDAI.sol#L52

Impact

The StableOracleDAI returns an inaccurate price.

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleDAI.sol#L52

Tool used

Manual Review

Recommendation

Remove the scale factor:

-    ((DAIWethPrice + uint256(price) * 1e10) / 2);
+    ((DAIWethPrice + uint256(price)) / 2);

Duplicate of #236