Submission Details
Severity:
For `getUsdValue()`, return early if amount is 0
Summary
For getUsdValue(), return early if amount is 0
Vulnerability Details
If the amount passed is 0, then the function can just return 0 as the USD value.
Otherwise, even for 0 amount, it calls the oracle to get the price which is completely unnecessary.
File: src/DSCEngine.sol
361: function getUsdValue(address token, uint256 amount) public view returns (uint256) {
AggregatorV3Interface priceFeed = AggregatorV3Interface(s_priceFeeds[token]);
(, int256 price,,,) = priceFeed.staleCheckLatestRoundData();
// 1 ETH = $1000
// The returned value from CL will be 1000 * 1e8
return ((uint256(price) * ADDITIONAL_FEED_PRECISION) * amount) / PRECISION;
}
Link to code - https://github.com/Cyfrin/2023-07-foundry-defi-stablecoin/blob/main/src/DSCEngine.sol#L361
Tools Used
Manual inspection
Recommendations
Consider adding a check for amount == 0 as:
File: src/DSCEngine.sol
361: function getUsdValue(address token, uint256 amount) public view returns (uint256) {
+ if (amount == 0) {
+ return 0;
+ }
AggregatorV3Interface priceFeed = AggregatorV3Interface(s_priceFeeds[token]);
(, int256 price,,,) = priceFeed.staleCheckLatestRoundData();
// 1 ETH = $1000
// The returned value from CL will be 1000 * 1e8
return ((uint256(price) * ADDITIONAL_FEED_PRECISION) * amount) / PRECISION;
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
23664 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.