# Wrong price scale for GasOracle

GasOracle multiplies two Chainlink oracle answers assuming 18 decimals, so feeds with other decimals inflate or under-report gas price.

- Payout: Audit contest
- Severity: high
- Program: Tracer
- Found by: cmichel
- Disclosed: 2021-09-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-06-tracer-findings/issues/93
- Library page: https://bugbountylibrary.com/r/c4%3A2021-06-tracer%3AH-06
- Tags: area:web3 domain:web3 kind:contest platform:code4rena sev:high tech:solidity vuln:oracle-manipulation vuln:precision-loss

**Target:** GasOracle price feed contract
**Root cause:** GasOracle multiplies raw latestAnswer values of a GAS/ETH feed and a USD/ETH feed and assumes the product is 18-decimal WAD, but the scale depends on each oracle's decimals; the toWad scaling helper is never used.
**Steps:**
1. Read GasOracle: it fetches two Chainlink oracles and multiplies their raw latestAnswer values.
2. Note the comment claiming the result is USD/Gas * 10^18.
3. Observe no chainlink.decimals() call and that toWad is unused, so scaling is fixed at 18 regardless of feed decimals.
4. Deploy/use a market with feeds whose decimals differ; the returned gas price is off by orders of magnitude.
**How found:** Code review of the oracle math: noticed the hardcoded 18-decimal assumption in the comment and that the toWad scaling function existed but was never called.
**Insight:** When a contract multiplies oracle answers, check whether decimals() is queried per feed; an unused scaling helper is a strong signal the author knew scaling mattered but forgot to apply it.