setDecimals can be set by anyone and not used

[code423n4]

Handle

0xRajeev

Vulnerability details

Impact

The setDecimals() in the sample Gas Price Oracle implementation allows anyone to set the decimals value used by the contract but is not used anywhere.

Impact: It is unclear if this should be set by anyone and if that value should be used in determining the precision of the values returned.

Proof of Concept

https://github.com/code-423n4/2021-06-tracer/blob/74e720ee100fd027c592ea44f272231ad4dfa2ab/src/contracts/oracle/GasOracle.sol#L64-L66

Tools Used

Manual Analysis

Recommended Mitigation Steps

Evaluate if this access and missing logic is correct.

[raymogg]

Lower severity as the setDecimals function is not used by anything within the GasOracle. This can just be considered redundant code

[cemozerr]

Marking this as non-critical as the code is redundant.