# Exchange rates from Compound are assumed with 18 decimals

CTokenMultiOracle hardcodes 18 decimals for Compound exchange rates, but they scale by 18-8+underlying decimals, causing incorrect token pricing.

- Payout: Audit contest
- Severity: high
- Program: Yield
- Found by: shw
- Disclosed: 2021-09-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-08-yield-findings/issues/38
- Library page: https://bugbountylibrary.com/r/c4%3A2021-08-yield%3AH-05
- Tags: area:web3 domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity vuln:oracle-manipulation vuln:precision-loss

**Target:** CTokenMultiOracle.sol oracle contract
**Root cause:** Oracle assumes Compound cToken exchange rates always have 18 decimals, but Compound scales them by 1*10^(18-8+underlying token decimals), so tokens with non-8-decimal underlying get mispriced.
**Steps:**
1. Read Compound docs: exchangeRateCurrent/Stored scaled by 1*10^(18-8+Underlying Token Decimals)
2. Inspect CTokenMultiOracle.sol L110 where Source decimals are set to 18 unconditionally
3. Observe underlying tokens with decimals != 8 yield wrong-scaled exchange rate
4. Result: incorrect pricing for those tokens
**How found:** Code review of oracle decimal handling cross-checked against Compound's documented exchange rate scaling formula.
**Insight:** When integrating lending-market oracles, verify the exchange-rate scaling formula per protocol rather than assuming 18 decimals; Compound's cToken rate depends on underlying token decimals.