Submission Details
Severity:
Chainlink oracle will return the wrong price if the aggregator hits `minPrice`
Summary
Vulnerability Details
Chainlink aggregators have a built-in circuit breaker if the price of an asset goes outside of a predetermined price band.
The result is that if an asset experiences a huge drop in value (i.e. LUNA crash) the price of the oracle will continue to return the minPrice instead of the actual price of the asset.
This would allow users to continue borrowing with the asset but at the wrong price. This is exactly what happened to Venus on BSC when LUNA crashed.
Code Snippet
File: DSCEngine.sol
// @audit missing min/max price check
345: (, int256 price,,,) = priceFeed.staleCheckLatestRoundData();
// @audit missing min/max price check
363: (, int256 price,,,) = priceFeed.staleCheckLatestRoundData();
Impact
This could enable users to keep borrowing the asset at an incorrect price.
Tools Used
Manual
Recommendations
Consider using the following checks:
(, int256 price,,,) = priceFeed.staleCheckLatestRoundData();
// minPrice check
require(price > minPrice, "Min price exceeded");
// maxPrice check
require(price < maxPrice, "Max price exceeded");
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
23664 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.