PegOracle incorrectly processes decimals for ETH-pairs thereby producing incorrect prices

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/oracles/PegOracle.sol#L67-L82

Vulnerability details

Impact

PegOracle combines two different Chainlink oracles, thereby allowing the protocol to directly compare prices of two different tokens. Chainlink has two main types of oracles, X/USD pairs and X/ETH pairs. The former uses 8 decimals, while the latter uses 18 decimals. PegOracle correctly handles X/USD pairs however incorrectly handles X/ETH pairs and therefore would incorrectly report any price which is derived from ETH pairs.

This will cause ETH pairs to produce prices which are too low and therefore vaults will automatically be registered as depegged even if the underlying assets have not depegged allowing hedge users to unfairly profit.

Proof of Concept

1. Admin deploys a new PegOracle based on ETH-pairs where decimals is initialised to be 18

        decimals = priceFeed1.decimals();

2. When latestRoundData() is called, nowPrice is calculated and has 4 decimals due to price2 and price1 cancelling each other's decimals

            //@audit 18 + 4 - 18
            nowPrice = (price2 * 10000) / price1;

3. As priceFeed1.decimals() has 18 decimals, decimals10 becomes 1

        int256 decimals10 = int256(10**(18 - priceFeed1.decimals()));

4. This means that nowPrice stays at 4 decimals and when it is returned it now has -2 decimals even though PegOracle.decimals() = 18

            //4 - 6 = -2 decimals
            nowPrice / 1000000

5. Therefore, for all relative prices under 100x, price rounds down to 0 which is incorrect

The current formula for the number of decimals of the returned price is 16 - x where x = priceFeed1.decimals(). Therefore, for 8 decimals (USD pairs) PegOracle is correct.

Tools Used

VS Code

Recommended Mitigation Steps

Rewrite latestRoundData() to:

    function latestRoundData()
        public
        view
        returns (
            uint80 roundID,
            int256 nowPrice,
            uint256 startedAt,
            uint256 timeStamp,
            uint80 answeredInRound
        )
    {
        (
            uint80 roundID1,
            int256 price1,
            uint256 startedAt1,
            uint256 timeStamp1,
            uint80 answeredInRound1
        ) = priceFeed1.latestRoundData();


        int256 price2 = getOracle2_Price();


        if (price1 > price2) {
            nowPrice = (price2 * decimals) / price1;
        } else {
            nowPrice = (price1 * decimals) / price2;
        }



        return (
            roundID1,
            nowPrice,
            startedAt1,
            timeStamp1,
            answeredInRound1
        );
    }

[scaraven]

I was in a bit of a rush when submitting this and made a mistake, the fix should be nowPrice = (price2 * 10**(decimals)) / price1;

[HickupHH3]

dup of #195