0xPkhatri - Incorrect Calculation return in StableOracleDAI#getPriceUSD Function

[sherlock-admin]

0xPkhatri

high

Incorrect Calculation return in StableOracleDAI#getPriceUSD Function

Summary

The StableOracleDAI#getPriceUSD function is incorrectly computing the DAI/USD price due to improper handling of exchange rates and decimal precision. A detailed given below.

Vulnerability Detail

In the StableOracleDAI#getPriceUSD function, three prices are used: wethPriceUSD, DAIWethPrice, and priceFeedDAIETH price to calculate the DAI/USD rate. However, there are two issues in the computation of the DAI/USD price:

1. while taking average we need to consider that DAIWethPriceis giving $\frac{WETH}{DAI}$ rate but chainlink priceFeedDAIETH price giving $\frac{DAI}{WETH}$ rate so while calculating average we calculate wrong rate.

        return
            (wethPriceUSD * 1e18) /
            ((DAIWethPrice + uint256(price) * 1e10) / 2);

2. The priceFeedDAIETH returns an 18-decimal rate, not an 8-decimal rate. This can be verified on Etherscan. Thus, when calculating the average, it's incorrect to multiply the price by $10^{10}$.

        // chainlink price data is 8 decimals for WETH/USD, so multiply by 10 decimals to get 18 decimal fractional

        (, int256 price, , , ) = priceFeedDAIETH.latestRoundData();

Impact

The incorrect DAI price calculation can result in a wrong price return from getPriceUSD function.

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleDAI.sol#L46-L53

Tool used

Manual Review

Recommendation

It's recommended to revise the calculation method used in the getPriceUSD function to correctly account for the different exchange rates and decimal precision.

Duplicate of #102

[0xPkhatri]

Escalate for 10 USDC

This is not a duplicate of #236
this is duplicate of #795

[sherlock-admin]

Escalate for 10 USDC

This is not a duplicate of #236
this is duplicate of #795

You've created a valid escalation for 10 USDC!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[hrishibhat]

Result:
High
Duplicate of #102

[sherlock-admin]

Escalations have been resolved successfully!

Escalation status:

• 0xPkhatri: accepted