# Incorrect handling of pricefeed.decimals()

PegOracle hardcodes 8-decimal Chainlink feeds; feeds with other decimals return wrong-magnitude or zero prices, breaking depeg detection and market settlement.

- Payout: Contest reward
- Severity: high
- Program: Y2k Finance
- Credited: carrotsmuggler
- Disclosed: 2023-01-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-y2k-finance-findings/issues/195
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-y2k-finance%3AH-01
- Tags: domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** PegOracle price oracle / Controller depeg check
**Root cause:** PegOracle scales the price ratio by 10**(18 - priceFeed1.decimals()) then divides by 1e6, implicitly assuming 8-decimal feeds; the net scaling becomes 10**(16-d), so any feed with d≠8 yields a wrong-magnitude price.
**Steps:**
1. Read PegOracle.getLatestPrice: `nowPrice = (price1 * 10000) / price2; nowPrice = nowPrice * int256(10**(18 - priceFeed1.decimals())); return nowPrice / 1000000;`
2. Compute net decimal scaling: +4 + (18-d) - 6 = 16-d, correct only when d=8
3. In AssertTest.t.sol:testPegOracleMarketCreation, replace oracle feed with usd-eth feed `0xB1552C5e96B312d0Bf8b554186F846C40614a540` (18 decimals)
4. Run test: price1/price2 integer division yields 0, oracle returns 0
5. Repeat with a 6-decimal mock feed: result is 4 orders of magnitude off
**How found:** Code review of the oracle math: tracked decimal scaling through the three arithmetic lines and noticed the hardcoded assumption of 8-decimal Chainlink feeds, then validated with Foundry tests using 18- and 6-decimal feeds.
**Exploitation:** Not weaponized; a misconfigured or non-8-decimal feed causes Controller's depeg check to compare against a 22-decimal value, misclassifying depeg events and mis-settling markets.
**Insight:** When auditing oracle adapters, algebraically sum the decimal scaling across every multiply/divide line; a single hardcoded `18 - decimals()` reveals the assumed feed precision, and swapping in a feed of different decimals in the existing test harness proves the break.