# Oracle decimal and unit mismatch

Trace decimals and quote unit from feed to final use; check ordering, chaining, and normalization

_Area: DeFi oracles, liquidations and flash loans. Seen in 38 disclosed reports; latest 2026-03-07. Updated 2026-10-23._

## How it works

Every price has a unit (what it is denominated in) and a decimal scale. Code consuming a feed must know both. The assumption that breaks is that the feed's scale or quote unit matches what the consumer expects, or that an intermediate value keeps the units of its source. When wrong, the price is off by a power of ten or a whole quote currency, and downstream math (collateral valuation, borrow limits, liquidation thresholds) accepts the wrong number. Usually nothing reverts; the contract just believes a false price.

## Where it shows up

- Adapters returning a DEX pool's raw price without checking token0/token1 ordering, plus hardcoded decimals [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-4.md)
- Chained routes (token→ETH→USD) where the intermediate amount's decimals differ from the feed's assumed source decimals [E2](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-01.md)
- External rate feeds (e.g. Pendle PT rates) assumed to be in token decimals when fixed at 18 [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-9.md)
- Oracle prices normalized to USD fed into Uniswap TickMath/LiquidityAmounts without converting back to raw token-wei [E4](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.2.md)
- Multiply-vs-divide by a scaling factor on an already-scaled value [E5](https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AH-2.md)
- Governance oracle swaps using a ratio feed as a USD price, dropping the quote-currency multiplication [E6](https://bugbountylibrary.com/r/dhl%3A20260215-moonwell.md)
- Cross-checks comparing two feeds (18-decimal vs 8-decimal) without normalizing before the delta [E7](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-14.md)
- Wrapper balanceOf treated as already in unitOfAccount when its decimals fall back to 18 [E8](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.2.3.md)

## How to review

For each price path, trace the unit and decimals of every value from feed to final use. Invariant: at each arithmetic step both operands share denomination and decimal scale, and the result is in the scale the consumer expects. Check token ordering in pool-derived prices [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-4.md), intermediate-amount decimals in chained routes [E2](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-01.md), and whether external rate feeds follow token decimals or a fixed convention (Pendle PT rates are always 18) [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-9.md). For Uniswap integrations, confirm sqrtPriceX96 is in raw token-wei coordinates, not oracle-normalized value space [E4](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.2.md). Confirm scaling factors are applied in the correct direction on already-scaled values [E5](https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AH-2.md). For governance config changes, diff the new derivation against the old and confirm the quote-currency multiplication is present [E6](https://bugbountylibrary.com/r/dhl%3A20260215-moonwell.md). For cross-checks, confirm both feeds share decimals before comparison [E7](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-14.md). For wrappers, confirm decimals() exists and matches unitOfAccount before the fallback-to-18 path is taken [E8](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.2.3.md).

## Variants seen

- Token-ordering assumption in DEX adapter with hardcoded decimals [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-4.md)
- Intermediate-amount decimals vs feed decimals in chained route [E2](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-01.md)
- External rate feed decimals assumed equal to token decimals [E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-9.md)
- Oracle-normalized USD ratio used where raw-wei coordinate expected [E4](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.2.md)
- Scaling factor multiplied instead of divided on an already-scaled value [E5](https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AH-2.md)
- Ratio feed used as USD price, missing quote multiplication [E6](https://bugbountylibrary.com/r/dhl%3A20260215-moonwell.md)
- Two feeds compared without decimal normalization [E7](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-14.md)
- Wrapper decimals fallback to 18 against a 6-decimal unit [E8](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.2.3.md)

## Why fixes fail

Fixes that patch one path leave sibling paths with the same assumption: mappings populated in both directions hide ordering bugs [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-4.md), and same-decimal test tokens mask scaling errors [E4](https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.2.md). Normalize at the boundary, not per-callsite.

## Impact and severity

High to critical: inflated collateral enabling overborrowing [E2](https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-01.md)[E3](https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-9.md), mispriced redemptions causing loss of funds [E1](https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-4.md), mass liquidations and bad debt [E6](https://bugbountylibrary.com/r/dhl%3A20260215-moonwell.md), and DoS of freshness checks [E7](https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-14.md). Severity rises when the mispricing is silent, affects many tokens, or is locked in by governance config.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2024-12-plaza-finance%3AH-4.md
- E2: https://bugbountylibrary.com/r/c4%3A2024-04-noya%3AH-01.md
- E3: https://bugbountylibrary.com/r/sherlock%3A2024-06-leveraged-vaults%3AH-9.md
- E4: https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.1.2.md
- E5: https://bugbountylibrary.com/r/sherlock%3A2023-10-notional%3AH-2.md
- E6: https://bugbountylibrary.com/r/dhl%3A20260215-moonwell.md
- E7: https://bugbountylibrary.com/r/sherlock%3A2025-07-malda%3AM-14.md
- E8: https://bugbountylibrary.com/r/cantina%3Avii_finance_jan2026%3A3.2.3.md