Steadefi

Summary

The contract's Chainlink Oracle integration, specifically in how it handles price deviations and the associated maxDeviation parameter, presents potential pitfalls. Inaccurate comments and a lack of specific checks could create operational vulnerabilities or misunderstandings, especially in scenarios where token prices exhibit little to no change.

Vulnerability Details

1. Ambiguous Commenting: The maxDeviation parameter within the addTokenMaxDeviation function is commented as representing a deviation "in seconds". However, in the context of the _badPriceDeviation function, it's clear that maxDeviation pertains to price percentages. This discrepancy can lead to misinterpretations and incorrect configurations.

2. Unnecessary Check: The addTokenMaxDeviation function has a superfluous check for maxDeviation < 0. Given that maxDeviation is a uint256, it inherently cannot be negative. This redundancy might cause confusion.

3. Zero Deviation Vulnerability: In scenarios where currentResponse.answer matches prevResponse.answer, the deviation calculation is zero. This is particularly plausible with stable tokens (e.g., USDC), which might experience minimal price fluctuations. Such a scenario might bypass the intended deviation checks.

Impact

If the contract's administrator misunderstands or misconfigures the maxDeviation parameter, the _badPriceDeviation function might not operate as intended. This can lead to the contract either overlooking genuine price anomalies or falsely identifying regular price changes as anomalies.

Tools Used

• Manual Code Analysis

Recommendations

1. Revise Commenting: Update the comment associated with the maxDeviation parameter in the addTokenMaxDeviation function to reflect its true purpose.

   /**

   * @notice Add Chainlink max deviation for token

   * @param token Token address

   * @param maxDeviation Max percentage deviation allowed, represented in 1e18 format

   */

2. Eliminate Redundancy: Remove the unnecessary check if (maxDeviation < 0) from the addTokenMaxDeviation function.

3. Handle Zero Deviation: Introduce mechanisms to address zero deviation scenarios, especially for stable tokens.

   if (currentResponse.answer == prevResponse.answer) {

   emit ZeroDeviationDetected(token);

   }

4. Refine maxDeviation Input Validation: Enhance the addTokenMaxDeviation function with input validation to ensure that the maxDeviation value falls within a logical and safe range.

   require(maxDeviation >= MIN_ACCEPTABLE_DEVIATION && maxDeviation <= MAX_ACCEPTABLE_DEVIATION, "Deviation value out of acceptable range");

5. Documentation: It's crucial to maintain detailed documentation explaining the role and implications of the maxDeviation parameter. This can prevent misconfigurations and clarify its operational significance.