Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium

OracleLib.sol#staleCheckLatestRoundData() - There is no check for min and max accepted prices.

0xdeth

Summary

There is no check for min and max accepted prices.

Vulnerability Details

The protocol would be wise to implement a min and max accepted prices for their collateral tokens.
Imagine the following situation:
The price of a collateral drops by 50%. Many users will become eligible for liquidation. A bot that monitors users health can quickly liquidate a huge amount of users and receive very big rewards.

Impact

If a price of a collateral experiences an extreme price drop many users will become eligible for liquidation. They can be liquidated moments later, not having enough time to deposit more collateral.

Tools Used

Manual review

Recommendations

In these extreme situations it's better to freeze the function, reverting, if the price is way too low or too high.
The minPrice and maxPrice can be hardcoded for each collateral and/or can be modified from a function inside the DSCEngine.

function staleCheckLatestRoundData(AggregatorV3Interface priceFeed)
public
view
returns (uint80, int256, uint256, uint256, uint80)
{
(uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
priceFeed.latestRoundData();
​
// Add some extra checks here.
require(answer >= minPrice, "Price is lower than the min price");
require(answer <= maxPrice, "Price is higher than the max price");
uint256 secondsSince = block.timestamp - updatedAt;
if (secondsSince > TIMEOUT) revert OracleLib__StalePrice();
​
return (roundId, answer, startedAt, updatedAt, answeredInRound);
}
​

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.