# CTokenOracle.sol#getCErc20Price contains critical math error

CTokenOracle.getCErc20Price divided by raw decimals instead of 10**decimals, overvaluing cTokens by orders of magnitude and enabling reserve drain.

- Payout: Contest reward
- Severity: high
- Program: Sentiment
- Credited: 0x52
- Disclosed: 2022-08-30
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2022-08-sentiment-judging/tree/main/021-H
- Library page: https://bugbountylibrary.com/r/sherlock%3A2022-08-sentiment%3AH-3
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:oracle-manipulation

**Target:** Compound cToken price oracle (CTokenOracle.sol)
**Root cause:** getCErc20Price scales exchangeRateStored by mulDivDown(1e8, IERC20(underlying).decimals()) instead of dividing by 10**decimals, so the cToken price is inflated by many orders of magnitude.
**Steps:**
1. Read CTokenOracle.getCErc20Price: `cToken.exchangeRateStored().mulDivDown(1e8, IERC20(underlying).decimals()).mulWadDown(oracle.getPrice(underlying))`
2. Note divisor is raw decimals (e.g. 6 or 18) rather than 10**decimals
3. Observe resulting cToken price is inflated by ~1e6-1e18x
4. Deposit one cToken as collateral, borrow against the inflated valuation, drain lending pools
**How found:** Code review of the oracle's decimal scaling logic; spotted that decimals() was used directly as a divisor instead of being exponentiated to 10**decimals.
**Exploitation:** Attacker deposits a single cToken whose oracle price is massively overstated, then borrows against that inflated collateral to drain all liquidity pools' reserves.
**Insight:** In oracle price math, always verify decimal normalization: a raw decimals() value used as a divisor instead of 10**decimals silently inflates prices by orders of magnitude, turning any collateral into free borrowing power.