Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`OracleLib.sol` will return the wrong price for asset if underlying aggregator hits minAnswer

mo_

Summary

Chainlink aggregators have a built in circuit breaker if the price of an asset goes outside of a predetermined price range. The result is that if an asset faces a huge drop in value (i.e. LUNA crash) the price of the oracle will continue to return the minPrice instead of the actual price of the asset.
This happened before to Venus on BSC when LUNA imploded.

Vulnerability Details

OffchainAggregator.sol#L680-L684

int192 median = r.observations[r.observations.length/2];
require(minAnswer <= median && median <= maxAnswer, "median is out of min-max range");
r.hotVars.latestAggregatorRoundId++;
s_transmissions[r.hotVars.latestAggregatorRoundId] =
Transmission(median, uint64(block.timestamp));

ChainlinkAggregators have minPrice and maxPrice circuit breakers built into them. This prevents the aggregator from updating the price below the minPrice specified at contract creation.

The logic in Oraclelib.sol looks like this

function staleCheckLatestRoundData(AggregatorV3Interface priceFeed)
public
view
returns (uint80, int256, uint256, uint256, uint80)
{
(uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
priceFeed.latestRoundData();
​
uint256 secondsSince = block.timestamp - updatedAt;
if (secondsSince > TIMEOUT) revert OracleLib__StalePrice();
​
return (roundId, answer, startedAt, updatedAt, answeredInRound);
}

As per the logic , if the price of the asset drops below the minPrice, the protocol will continue to value the token at minPrice instead of it's actual value.
Example:

TokenA has a minPrice of 1 dollar . The price of TokenA drops to 0.10 dollar . The aggregator still returns 1 dollar allowing the user to borrow against TokenA as if it is $1 which is 10x it's actual value .

which leads to a protocol malfunction .

Simillar findings

Impact

In the event that an asset crashes (i.e. LUNA) the protocol can be manipulated to mint out dsc at an inflated price .

Tools Used

Manual review .

Recommendations

Pull minAnswer from the aggregator and revert it price == minAnswer

or ,

Use a secondary on-chain liquidity-based oracle like Uniswap TWAP to check for the price difference. Revert when price difference is too high.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.