Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

unsafe chainlink price cast

chaos304

Summary

typecasting price returned by chainlink to uint256 could possibly underflow

Vulnerability Details

The price value returned by the chainlink oracles is a signed integer and therefore in an unlikely however possible scenario could return a negative value which would underflow when cast to a uin256 in the following function

function getTokenAmountFromUsd(address token, uint256 usdAmountInWei) public view returns (uint256) {
// price of ETH (token)
// $/ETH ETH ??
// $2000 / ETH. $1000 = 0.5 ETH
AggregatorV3Interface priceFeed = AggregatorV3Interface(s_priceFeeds[token]);
(, int256 price,,,) = priceFeed.staleCheckLatestRoundData();
// ($10e18 * 1e18) / ($2000e8 * 1e10)
return (usdAmountInWei * PRECISION) / (uint256(price) * ADDITIONAL_FEED_PRECISION);
}
function getUsdValue(address token, uint256 amount) public view returns (uint256) {
AggregatorV3Interface priceFeed = AggregatorV3Interface(s_priceFeeds[token]);
(, int256 price,,,) = priceFeed.staleCheckLatestRoundData();
// 1 ETH = $1000
// The returned value from CL will be 1000 * 1e8
return ((uint256(price) * ADDITIONAL_FEED_PRECISION) * amount) / PRECISION;
}

it is recommended to check for such a case to reduce impact in case of an attack on chainlink. assuming that this does in fact happen it could result in users being able to mint and use marginally more tokens than they should otherwise be able to while not being able to be liquidated.
it would also stop others from minting any more tokens as the total supply might reach to or close to the max number allowed by uint256 and so any new minting would be reverted.

Impact

Given the likelihood of this happening is low, the impact is MEDIUM.

Tools Used

Manual Review

Recommendations

consider checking whether the value of the price variable is below zero or not and revert if so.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.