Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Cannot liquidate positions if the oracle prices are equal zero

devival

Summary

In the unlikely event that the price of an asset reaches zero, there is no way to liquidate the position, because the getTokenAmountFromUsd function will revert.

Vulnerability Details

The usage of off-chain oracle prices in DSCEngine.sol that can lead to a possible division by zero (an exception that will result in a reverted transaction):

function getTokenAmountFromUsd(address token, uint256 usdAmountInWei) public view returns (uint256) {
// price of ETH (token)
// $/ETH ETH ??
// $2000 / ETH. $1000 = 0.5 ETH
AggregatorV3Interface priceFeed = AggregatorV3Interface(s_priceFeeds[token]);
@> (, int256 price,,,) = priceFeed.staleCheckLatestRoundData();
// ($10e18 * 1e18) / ($2000e8 * 1e10)
@> return (usdAmountInWei * PRECISION) / (uint256(price) * ADDITIONAL_FEED_PRECISION);
}

Impact

Positions won't be liquidatable, at an extremely critical moment that they should be liquidatable. Losses and fees will grow and DSC system will become insolvent.

Tools Used

Manual review

Recommendations

Provide a mechanism for positions to be liquidated even if the price reaches zero or goes negative.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.