Submission Details
Severity:
Returned oracle price not checking 0 value, could cause issue if oracle have problem
Summary
OracleLib functions staleCheckLatestRoundData is used to get price data for calculating collateral value, however it doesn't check if the price feed returning correct non-zero price, this can cause issue if oracle have problem and cause problem to the protocol.
Vulnerability Details
staleCheckLatestRoundData doesn't check if price is non-zero :
function staleCheckLatestRoundData(AggregatorV3Interface priceFeed)
public
view
returns (uint80, int256, uint256, uint256, uint80)
{
(uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
priceFeed.latestRoundData();
uint256 secondsSince = block.timestamp - updatedAt;
if (secondsSince > TIMEOUT) revert OracleLib__StalePrice();
return (roundId, answer, startedAt, updatedAt, answeredInRound);
}
This function is used to calculate token amount in term of usd when liquidate and calculating health factor,
Impact
protocol will be break if the price feed have problem.
Tools Used
Manual review
Recommendations
Check the returned price, if the returned price is 0, revert the call.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
23664 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.