DittoETH

Ditto
DeFiFoundryOracle
55,000 USDC
View results
Submission Details
Severity: medium
Invalid

Missing check for max/min price in getOraclePrice() function

Description:

The getOraclePrice() function does not check if the price of an asset is within the max/min range. This is a security vulnerability, as it could allow an attacker to manipulate the price of an asset and steal money from users.

Impact:

An attacker could exploit this vulnerability to:

  • Steal money from users by manipulating the price of an asset and then buying or selling the asset at a favorable price.

  • Disrupt the market for an asset by creating large price swings.

  • Prevent users from trading an asset by causing the price to exceed the max/min range.

##Recommendation:

To fix this vulnerability, you should add a check for the max/min price to the getOraclePrice() function. For example, you could add the following code:

// Check if the price is within the max/min range
if (price < minPrice || price > maxPrice) {
revert Errors.InvalidPrice();
}

we should also consider adding a circuit breaker to the getOraclePrice() function. This would allow you to temporarily disable the function if the price of an asset changes too quickly or unexpectedly.

Updates

Lead Judging Commences

0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issues

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.