Submitted by JecikPo, also found by linmiaomiao, kfx, KupiaSec, SpicyMeatball, kennedy1030, and t4sk
The price calculation at the V3Oracle.sol will revert upon reaching certain level when referenceToken is used with high decimal value (e.g. 18). The revert (specifically happening when calling getValue()) would make the Chainlink price feed useless; yet the TWAP price source would still be available. The protocol team would have to disable Chainlink and rely exclusively on the TWAP source reducing security of the pricing. The issue could manifest itself after certain amount of time once the project is already live and only when price returned by the feed reaches certain point.
The following code line has an issue:
When referenceTokenDecimals is 18, chainlinkPriceX96 is higher than some threshold between 18 and 19 (in Q96 notation), which will cause arithmetic overflow.
Instead of calculating the price this way:
It could be done the following way as per Chainlinks recommendation:
Reference here.
Decimal
kalinbas (Revert) confirmed
Revert mitigated:
Status: Mitigation confirmed. Full details in reports from ktg, thank_you and b0g0.
