# LOSS OF PRECISION RESULTING IN WRONG VALUE FOR PRICE RATIO

PegOracle divides by 1e6 then Controller re-multiplies, truncating the stETH/ETH peg ratio and misjudging depeg status, risking vault funds.

- Payout: Contest reward
- Severity: high
- Program: Y2k Finance
- Credited: 0xDecorativePineapple
- Disclosed: 2023-01-09
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-y2k-finance-findings/issues/323
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-y2k-finance%3AH-05
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:oracle-manipulation vuln:precision-loss

**Target:** PegOracle.sol price oracle / Controller.sol
**Root cause:** PegOracle computes (price*1e4)/price then divides by 1e6, truncating precision; Controller then re-scales by 10**(18-decimals), compounding the error instead of computing x*1e18/y directly.
**Steps:**
1. Read PegOracle.latestRoundData: `nowPrice = (price2*10000)/price1` then `nowPrice = nowPrice*decimals10` then `return nowPrice/1000000`.
2. Note Controller.sol#L299-300 re-multiplies returned value by `10**(18-priceFeed.decimals())`.
3. Fork Arbitrum with `forge test --fork-url https://arb1.arbitrum.io/rpc -vv`.
4. Compare latestRoundData (contract logic) vs latestRoundData2 (x*1e18/y) for stETH/ETH, FRAX/FEI, DAI/FEI pairs.
5. Observe divergence e.g. 990500000000000000 vs 990544616614592905 and 996300000000000000 vs 1003669952945847834.
**How found:** Code reading of PegOracle arithmetic: noticed multiply-by-1e4 then divide-by-1e6 truncation and the Controller's subsequent re-scaling, hypothesized precision loss; validated by forking Arbitrum and diffing against a Chainlink-style x*1e18/y reference.
**Exploitation:** Not directly weaponized in text; incorrect ratio can flip depeg determination, letting users enter/exit vaults at wrong strike comparison and misprice insurance payouts.
**Insight:** When an oracle returns a scaled ratio, check every intermediate division for truncation and whether the consumer re-scales the already-truncated value; compare against a direct x*1e18/y reference on a fork to quantify drift near the 1.0 peg threshold.