Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Implement Stringent Parameter Validations Within The Constructor Of A Contract

albertwhite

Summary

implement stringent parameter validations within the constructor of a contract

  1. Assure Order Correspondence

  2. Validate Chainlink Price Feed Existence

Vulnerability Details

constructor(address[] memory tokenAddresses, address[] memory priceFeedAddresses, address dscAddress) {
// USD Price Feeds
if (tokenAddresses.length != priceFeedAddresses.length) {
revert DSCEngine__TokenAddressesAndPriceFeedAddressesMustBeSameLength();
}
// For example ETH / USD, BTC / USD, MKR / USD, etc
for (uint256 i = 0; i < tokenAddresses.length; i++) {
s_priceFeeds[tokenAddresses[i]] = priceFeedAddresses[i];
s_collateralTokens.push(tokenAddresses[i]);
}
i_dsc = DecentralizedStableCoin(dscAddress);
}

There should add

  1. Assure Order Correspondence: Confirm that the order of tokenAddresses and priceFeedAddresses corresponds correctly. Misalignment or discrepancy between these two arrays can lead to improper mapping of tokens to their respective price feeds, potentially compromising the accuracy and reliability of your contract's financial computations.

  2. Validate Chainlink Price Feed Existence: Prior to utilizing a token within the contract, assert that the tokenAddress is associated with a valid Chainlink price feed.

Impact

compromising the accuracy and reliability of your contract's financial computations. Let the invariant fail.

Tools Used

manually reviewed

Recommendations

Solution 1: use chainlink Feed Registry API, get the price feed by using this method

function getFeed(address base, address quote) external view returns (AggregatorV2V3Interface aggregator);
​

Solution 2: call the OracleLib.staleCheckLatestRoundData in the contractor, and check if all price feed works and has returned the right value, if not revert the transaction.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.