Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Chainlink lacks parameter validation, which may lead to errors or outdated prices.

polaris_tow

Summary

The contract uses the latestRoundData function to fetch prices from the Chainlink aggregator, but lacks some parameter validation, which may result in the application using incorrect asset prices.

Vulnerability Details

In the staleCheckLatestRoundData function, it checks for updatedAt, but lacks checks for other parameters, such as roundId, answer, and answeredInRound. This may result in incorrect prices.
Chainlink aggregators have a built-in circuit breaker if the price of an asset goes outside of a predetermined price band.
The result is that if an asset experiences a huge drop in value (i.e. LUNA crash) the price of the oracle will continue to return the minPrice instead of the actual price of the asset.

This would allow users to continue borrowing with the asset but at the wrong price. This is exactly what happened to Venus on BSC when LUNA crashed.

(uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
priceFeed.latestRoundData();
​
uint256 secondsSince = block.timestamp - updatedAt;
if (secondsSince > TIMEOUT) revert OracleLib__StalePrice();
​
return (roundId, answer, startedAt, updatedAt, answeredInRound);

Impact

Chainlink will return incorrect prices, leading to financial losses.

Tools Used

Manual review

Recommendations

It is recommended to add checks for these parameters, for example：

// minPrice check
require(answer > minPrice, "Min price exceeded");
// maxPrice check
require(answer < maxPrice, "Max price exceeded");
require(answeredInRound >= roundID, "Stale price");

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.