kutugu - StableOracleDAI price calculation error

[sherlock-admin]

kutugu

high

StableOracleDAI price calculation error

Summary

StableOracleDAI price calculation error

Vulnerability Detail

Note: because the code does not specify the exact calculation that each price represents. I'm basing my inferences on variable names, so it might be wrong.

• wethPriceUSD: GUESS weth price in usd unit.
• DAIWethPrice: GUESS dai price in weth unit.
• price: IS dai price in weth unit, 18 decimals.

If the above conditions are true, the correct DAI price should be (wethPriceUSD * 1e18) * ((DAIWethPrice + uint256(price)) / 2);

• wethPriceUSD: GUESS weth price in usd unit.
• DAIWethPrice: GUESS weth price in dai unit.
• price: IS dai price in weth unit, 18 decimals.

If the above conditions are true, the correct DAI price should be (wethPriceUSD * 1e18) / ((DAIWethPrice + 1e18 / uint256(price)) / 2);

Impact

High. Oracle price calculation error.

Code Snippet

StableOracleDAI

return
            (wethPriceUSD * 1e18) /
            ((DAIWethPrice + uint256(price) * 1e10) / 2);

Tool used

Manual Review

Recommendation

Use correct calculation

Duplicate of #236