# `ChainlinkOracle.sol#getPrice()` The price will be wrong when the token's USD price feed's `decimals != 8`

ChainlinkOracle.getPrice divides token feed answer by ETH feed answer assuming both have 8 decimals, so feeds with other decimals return wildly wrong ETH prices.

- Payout: Contest reward
- Severity: high
- Program: Sentiment
- Credited: Lambda
- Disclosed: 2022-08-30
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-08-sentiment-judging/tree/main/019-H
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** ChainlinkOracle.getPrice / RiskEngine._valueInWei
**Root cause:** getPrice computes uint(answer)*1e18/getEthPrice() without normalizing for feed[token].decimals(), implicitly requiring token feed decimals equal the ETH/USD feed's 8 decimals.
**Steps:**
1. Identify a token whose Chainlink USD feed has decimals != 8, e.g. AMPL/USD with decimals=18.
2. Call `chainlinkOracle.getPrice(AMPL)`; with answer_ampl=1140608758261546000 and answer_eth=158811562094 it returns ~7.18e24 instead of ~1.14e18/1588.
3. Observe RiskEngine._valueInWei uses this inflated price to value collateral.
4. Deposit a small amount of the mispriced asset and borrow/drain against the inflated collateral value.
**How found:** Code reading of getPrice and getEthPrice revealed the implicit assumption that token feed decimals equal the ETH feed's 8 decimals; checked real Chainlink feeds (AMPL/USD) to confirm a counterexample.
**Exploitation:** Attacker deposits a small amount of a token whose feed decimals != 8; the oracle overvalues it by many orders of magnitude, letting them borrow/drain all protocol funds.
**Insight:** When an oracle divides two Chainlink answers, verify each feed's decimals() independently — token/USD feeds vary (AMPL is 18) while ETH/USD is 8, so unnormalized division inflates collateral value enormously.