Summary

Chainlink price feeds have in-built minimum & maximum prices they will return; if during a flash crash, bridge compromise or depegging event a collateral asset's value falls below the price feed's minimum price, the oracle price feed will continue to report the (now incorrect) minimum price. An attacker could use this to extract value from the protocol.

Vulnerability Details

In such an event, an attacker could:

• buy the collateral asset using a decentralized exchange at the very low price,

• deposit the collateral asset into the protocol,

• mint DSC against the collateral asset at the minimum price Chainlink's price feed returns, even though the actual price is far lower,

• swap DSC for USDC or another stablecoin,

• allow their collateral asset position to be liquidated since it is worth far less than the protocol believes.

Impact

An attacker can extract value from the protocol as the protocol is pricing the collateral above the market price.

Tools Used

Manual

Recommendations

Check that minAnswer < receivedAnswer < maxAnswer, or compare Chainlink's price to another price source such as Uniswap V3 TWAP and revert if the UniswapV3 TWAP price is not within Chainlink's [minAnswer, maxAnswer] valid range.

This attack could also potentially be mitigated off-chain via off-chain monitoring which compares Chainlink's latest reported price to other off-chain sources such as centralized exchanges and/or liquid indexes which aggregate multiple off-chain price sources to produce one index price; if external sources are reporting prices lower than Chainlink's minAnswer, off-chain monitoring could disable the smart contract's price feed for that asset, forcing any transactions to revert.