Skip to content

Oracle Decimals Assumed / Mismatched

SAFE-0203 Oracle / Price Checked automatically by the scanner
1

What goes wrong

The code assumes a fixed number of decimals for a feed (e.g. hardcodes 1e8 or 1e18) instead of reading feed.decimals(). A feed with different precision, or a token with non-18 decimals, mis-scales every downstream calculation by orders of magnitude.

2

The vulnerable pattern

proof of concept — how it is exploited
// code does price = answer / 1e8 assuming 8 decimals.
// a JPY or non-standard feed returns 18-decimal answers
// -> price is 1e10x wrong, collateral massively over/under valued.
3

How to fix it

the pattern that is safe
uint8 dec = feed.decimals();
uint256 price = uint256(answer) * 1e18 / (10 ** dec);
Always read feed.decimals() and token.decimals().
4

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0203 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs