fix: add pyth decimals sanity check

Gearbox-protocol · May 13, 2024 · d62b0e5 · d62b0e5
1 parent 01c5059
commit d62b0e5
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/contracts/oracles/updatable/PythPriceFeed.sol b/contracts/oracles/updatable/PythPriceFeed.sol
@@ -29,6 +29,9 @@ interface IPythPriceFeedExceptions {
     /// @notice Thrown when the timestamp sent with the payload for early stop does not match
     ///         the payload's internal timestamp
     error IncorrectExpectedPublishTimestamp();
+
+    /// @notice Thrown when the decimals returned by Pyth are outside sane boundaries
+    error IncorrectPriceDecimals();
 }
 
 /// @title Pyth price feed
@@ -99,6 +102,7 @@ contract PythPriceFeed is IUpdatablePriceFeed, IPythPriceFeedExceptions {
         int256 price = int256(priceData.price);
 
         if (priceData.expo != -8) {
+            if (priceData.expo > 0 || priceData.expo < -255) revert IncorrectPriceDecimals();
             int256 pythDecimals = int256(10 ** uint32(-priceData.expo));
             price = price * DECIMALS / pythDecimals;
         }

diff --git a/contracts/test/unit/updatable/PythPriceFeed.unit.t.sol b/contracts/test/unit/updatable/PythPriceFeed.unit.t.sol
@@ -131,5 +131,15 @@ contract PythPriceFeedUnitTest is TestHelper, IPythPriceFeedExceptions {
         (, price,,,) = pf.latestRoundData();
 
         assertEq(price, 100 * 10 ** 8, "Incorrect price when pyth decimals are 0");
+
+        pyth.setPriceData(bytes32(uint256(1)), 100, 0, 2, block.timestamp);
+
+        vm.expectRevert(IncorrectPriceDecimals.selector);
+        pf.latestRoundData();
+
+        pyth.setPriceData(bytes32(uint256(1)), 100, 0, -257, block.timestamp);
+
+        vm.expectRevert(IncorrectPriceDecimals.selector);
+        pf.latestRoundData();
     }
 }