# Hardcoded 1e18 ratio calculation regardless of decimals Low/Info · Three Sigma · Oracles · 16th October 2024 Finding 3S-Ojo-L01 of the Ojo Mellow Price Feed security review. - Protocol: https://www.ojo.network/ - Report: /reports/ojo-mellow-price-feed - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-10-16-ojo-network.pdf --- ### Description MellowPriceFeed gets the ratio by doing answer = int256(uint256(ratiosX96[0])) * 1e18 / int256(managedRatiosOracle.Q96());, hardcoding the decimals to 1e18. However, the decimals are set in the constructor and stored in priceFeedDecimals, and could differ from 1e18. ### Recommendation answer = int256(uint256(ratiosX96[0])) * 10**priceFeedDecimals / int256(managedRatiosOracle.Q96()); ### Status Addressed in [#ad88fe1](https://github.com/ojo-network/ojo-evm/pull/55/commits/ad88fe1435f09023b5b81cbe0ed30a33e777cc7e). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Hardcoded 1e18 in SyrupRateProvider](https://0xsimao.com/findings/maple-finance-syrup-router-hardcoded-1e18-rate-provider): Maple Syrup Router