PegOracle.sol always returns 0 for assets with 18 decimals

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/ac3e86f07bc2f1f51148d2265cc897e8b494adf7/src/oracles/PegOracle.sol#L46-L83

Vulnerability details

Impact

PegOracle.sol always returns 0 for assets with 18 decimals due to precision loss, which is a majority of all chainlink oracles

Proof of Concept

nowPrice = (price2 * 10000) / price1;

nowPrice is set to the ratio between prices scaled to 4 decimals. If the oracle return 18 decimals (as a vast majority of chainlink oracles do) then the price will not be scaled at all. When the ratio is returned, it is divided by 1,000,000. Since the ratio is only scaled to 4 decimals and is being divided 7 decimals the division will always return 0 due to precision loss. Additionally in the contest description it states that it should return as 18 decimals but in no scenario does it return the ratio to 18 decimals.

Tools Used

Recommended Mitigation Steps

PegOracle.sol#latestRoundData price calculations should be rewritten as follows:

//price is multiplied by 10**decimals to preserve the underlying decimals in the ratio
if (price1 > price2) {
    nowPrice = (price2 * (10**decimals)) / price1;
} else {
    nowPrice = (price1 * (10**decimals)) / price2;
}

//ratio is scaled to 18 decimals if not already
int256 decimals10 = int256(10**(18 - decimals));
nowPrice = nowPrice * decimals10;

return (
    roundID1,
    nowPrice,
    startedAt1,
    timeStamp1,
    answeredInRound1
);

[MiguelBits]

dup #305

[HickupHH3]

dup #195