Foundry DeFi Stablecoin CodeHawks Audit Contest

Summary

No checks for negative price in OracleLib.sol

Vulnerability Details

Chainlink data feeds uses int256 instead of uint256 to return prices of assets in case of negative prices , it is a very rare scenario when an asset's price drops below zero (eg. oil price drops below zero ). It is a good practise to be aware of this scenario and have a strategy to face that scenario .

But OracleLib.sol doesnot have any checks regarding the scenario .

Impact

Protocol will fail to function properly if an assets value drops below zero

Tools Used

Manual review

Recommendations

Consider adding this check to sanitize the price returned from oracle

require(answer > 0, "invalid price");