# FixedRateOracle misprices wrapper collateral when unitOfAccount is not 18 decimals

FixedRateOracle assumed 18 decimals for the wrapper, so with a 6-decimal unitOfAccount like USDC, balanceOf quotes truncated to 0, making collateralized accounts appear empty.

- Payout: Contest reward
- Severity: medium
- Program: VII Finance
- Credited: 0xmechanic
- Disclosed: 2026-03-07
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_vii_finance_jan2026.pdf#3.2.3
- Library page: https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.2.3
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation vuln:precision-loss

**Target:** FixedRateOracle / UniswapV3WrapperFactory in Euler v2 market integration
**Root cause:** Wrapper lacks decimals(), so _getDecimals falls back to 18 while unitOfAccount is 6; the fixed-rate scaling 10^(base+quote)=10^24 truncates balanceOf values to 0 instead of 1:1.
**Steps:**
1. Deploy UniswapV3WrapperFactory with a 6-decimal unitOfAccount (USDC-like).
2. Create wrapper via `factory.createUniswapV3Wrapper(oracle, unitOfAccount, pool)`; wrapper has no decimals() so baseDecimals=18, quoteDecimals=6.
3. Call `FixedRateOracle(fixedRateOracle).getQuote(20e6, wrapper, unitOfAccount)`.
4. Observe out = 20e6 * 1e6 * 1e6 / 1e24 = 0 instead of 20e6.
**How found:** Code review of factory oracle deployment and BaseAdapter._getDecimals fallback-to-18 behavior, noting wrapper lacks decimals() while unitOfAccount may be 6-decimal per Euler docs.
**Exploitation:** Any EVC account status check (unwrap, ERC6909 transfer, disableTokenIdAsCollateral) reads ~0 collateral, blocking actions and enabling wrongful liquidation of healthy positions; quote stays 0 until ~1,000,000 USDC inAmount.
**Insight:** When an oracle treats a wrapper's balanceOf as already-denominated in unitOfAccount, verify the wrapper exposes decimals() matching that unit; the _getDecimals fallback to 18 silently breaks 1:1 scaling for 6-decimal units like USDC.