PegOracle doesn't support decimals other than 8

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/oracles/PegOracle.sol#L73-L78

Vulnerability details

Impact

PegOracle reports wrong prices when the underlying oracle use decimals other than 8. A price reported by PegOracle
can trigger a depeg event immediately after an epoch has started.

Proof of Concept

function testPegOracleDecimals() public {
    DepegOracle ethOracle = new DepegOracle(address(oracleETH), address(admin));
    DepegOracle stethOracle = new DepegOracle(address(oracleSTETH), address(admin));
    ethOracle.setDecimals(14);
    stethOracle.setDecimals(14);

    // A peg oracle for ETH/stETH (ETH/USD and stETH/USD)
    PegOracle pegOracle = new PegOracle(address(ethOracle), address(stethOracle));

    // ETH/stETH is 1
    vm.startPrank(admin);
    ethOracle.setPriceSimulation(5000e14);
    stethOracle.setPriceSimulation(5000e14);
    vm.stopPrank();
    (,int256 nowPrice, , ,) = pegOracle.latestRoundData();

    // Expected: 1e14, actual: 100
    assertEq(nowPrice, 1e14);
}

In the above case, the underlying oracles use 14 decimals; the prices they report also use 14 decimals. It's expected
that the PegOracle reports 1e14, but it reports 100–this is way below any reasonable strike price. The Controller
won't be able to scale the price: it will multiply
100 by 10**(18-14), which equals 100e4, not 1e14.

While most Chainlink oracles use 8 decimals, some of them use 18 (all ETH pairs, e.g. LINK/ETH).

Recommended Mitigation Steps

In the latestRoundData
function of PegOracle, scale the final price to match the decimals of the underlying oracles.

[MiguelBits]

dup #305

[HickupHH3]

dup #195