# Wrong decimal precision resulted in the price being inflated

PendlePTOracle assumed Pendle's PT rate was in PT decimals, but it's 18 decimals, inflating collateral price for 6-decimal PTs and enabling overborrowing.

- Payout: Contest reward
- Severity: high
- Program: Leveraged Vaults
- Credited: nirohgo
- Disclosed: 2024-06-18
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2024-06-leveraged-vaults-judging/issues/66
- Library page: https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-9
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity vuln:oracle-manipulation vuln:precision-loss

**Target:** PendlePTOracle.sol price calculation
**Root cause:** The oracle divides by ptDecimals (PT token decimals) assuming the Pendle PT rate is denominated in PT decimals, but Pendle returns the rate in 18 decimals. For PTs with non-18 decimals, the price is inflated by 10^(18 - ptDecimals).
**Steps:**
1. Deploy PendlePTOracle for a PT token with 6 decimals (e.g., PT fUSDC 26DEC2024).
2. Set useSyOracleRate=false so _getPTRate calls Pendle's getPtToAssetRate, which returns a rate in 18 decimals (e.g., 978197897539187120 for ~0.978).
3. Call latestRoundData; _calculateBaseToQuote computes answer = (ptRate * baseToUSD * 1e18) / (baseToUSDDecimals * 1e6).
4. With baseToUSD=99990557 (8 decimals) and baseToUSDDecimals=1e8, answer = 9.78e29 instead of ~1e18, inflating the price by 1e12.
**How found:** The auditors reviewed the oracle's decimal handling and noticed that Pendle's getPtToAssetRate returns an 18-decimal rate, while the code divides by ptDecimals (the PT token's decimals). They verified with a concrete PT (6 decimals) that the output was inflated by 12 orders of magnitude.
**Exploitation:** A malicious user deposits the affected PT as collateral. The inflated oracle price makes the collateral appear worth 1e12 times more, allowing the attacker to borrow far more than the actual collateral value and drain assets from the protocol.
**Insight:** When integrating external oracles, verify the decimals of returned rates against the token's decimals; Pendle's PT/asset rates are always 18 decimals regardless of the PT token's decimals.