Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Lacking Validation Of Chainlink’ Oracle Queries

Dharma

Summary

Vulnerability Details

The staleChecklatestRoundData function in the contract OracleLib.sol fetches the asset price from a Chainlink aggregator using the staleChecklatestRoundData function. However, there are no checks on roundID.

Impact

Stale prices could put funds at risk. According to Chainlink's documentation, This function does not error if no answer has been reached but returns 0, causing an incorrect price fed to the PriceOracle. The external Chainlink oracle, which provides index price information to the system, introduces risk inherent to any dependency on third-party data sources. For example, the oracle could fall behind or otherwise fail to be maintained, resulting in outdated data being fed to the index price calculations of the liquidity.

Tools Used

Manual code review. Chainlink best practices.

Recommendations

Consider to add checks on the return data with proper revert messages if the price is stale or the round is incomplete, for example:

require(price > 0, "Chainlink price <= 0");
require(answeredInRound >= roundID, "...");
require(timeStamp != 0, "...");

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.