15,000 USDC
View results
Submission Details
Severity: medium
Valid

Oracle price-feeder is vulnerable to manipulation by a single malicious price feed

Summary

an asset price could
The contract uses only one price feed - Chainlink. The price feed could easily be manipulated by only one compromised or malfunctioning third-party provider (Chainlink).

Vulnerability Details

There is no price feed that is fully protected against attack. Chainlink can be manipulated by an attacker or internally. As it stands, the contract is at the mercy of Chainlink.

Impact

This can result to incorrect collateral calculation and excessive minting of DSC with less than required collateral.

Tools Used

Manual review

Recommendations

Use two or three price feeder.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.