Submitted by cmichel
https://github.com/code-423n4/2022-02-hubble/blob/8c157f519bc32e552f8cc832ecc75dc381faa91e/contracts/Oracle.sol#L34
The Oracle.getUnderlyingPrice function divides the chainlink price by 100.
It probably assumes that the answer for the underlying is in 8 decimals but then wants to reduce it for 6 decimals to match USDC.
However, arbitrary underlying tokens are used and the chainlink oracles can have different decimals.
While most USD price feeds use 8 decimals, its better to take the on-chain reported decimals into account by doing AggregatorV3Interface(chainLinkAggregatorMap[underlying]).decimals(), see Chainlink docs.
The price should then be scaled down to 6 decimals.
atvanguard (Hubble) confirmed, but disagreed with High severity and commented:
moose-code (judge) decreased severity to Medium and commented:
