Submission Details
Severity:
Chainlink price not properly checked
Summary
ChainLink price not fully checked
Vulnerability Details
Ad it stand from the code only the staleness of the data is checked ,which in most cases in not enough. Many scenarios involve where the feed is active and refreshing, but the data it provides is not of best quality. Example is when Luna hit it's min threshold of 0.10$, ChainLink continued to provide fresh, but inaccurate data.
Impact
Prices can hit the min/max threshold and still be fresh, tho not accurate.
Tools Used
Manual review
Recommendations
To address this issue, it is important to include a simple check to verify the data
function staleCheckLatestRoundData() external view override returns (uint256) {
(uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) = priceFeed.latestRoundData();
+ if(answeredInRound < roundId) revert StalePrice();
+ if(price <= 0) revert ZeroPrice();
+ if(minPrice >= price => maxPrice) revert MinMaxPriceReached();
...
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
23664 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.