Steadefi

Summary

When the consultIn18Decimals() is called, can be returned a negative value. Because not exist correct validation for negative response.

Vulnerability Details

The ChainlinkARBOracle.sol has to garantie delivered correct price. Howerver exist a potencial scenario of this situation may be breaking.

Lets break each one part of this scenario:

1. When consultIn18Decimals() is called, and call to consult() this function is encharge of verifie each answer and delivere a price not old, not zero,non-negative and garantie of sequencer is up.

2. Posible scenario in consult() for the moment, we have:
   chainlinkResponse.answer = x where x > 0
prevChainlinkResponse.answer = y where y < 0 This is a negative value given by Chainlink

3. _chainlinkIsFrozen() is pass correctly

4. _chainlinkIsBroken(chainlinkResponse, prevChainlinkResponse, token) evaluate the following functions:

   • _badChainlinkResponse(currentResponse) pass correctly.

   • _badChainlinkResponse(prevResponse) pass also correctly because is only check if the value is zero, but not negative
     see : if (response.answer == 0) { return true; }

   • _badPriceDeviation(currentResponse, prevResponse, token):
     if( currentResponse.answer > prevResponse.answer) remember currentResponse.answer = x where x > 0 and prevResponse.answer = y where y < 0 So. x > y . This condition is passed successfully..

5. For the evaluation of _deviation we have:
   _deviation = uint256(currentResponse.answer - prevResponse.answer) * SAFE_MULTIPLIER / uint256(prevResponse.answer); The result will always return zero. So validation on _badPriceDeviationof_deviation > maxDeviations[token]always returnsfalsebecause zero can never be greater for any number ofmaxDeviations[token]since it only accepts numbers of typeuint256 `

POC :

This scenario is illustrated in a minimalist example, which you can use in Remix:

Impact

High, the base protocol is how you get the price of the securities. The answer may be different than what is allowed. Because the maximum deviations will not be counted.

Tools Used

• Manual code review

• Remix

Recommendations

This behavior can be mitigated by setting the correct conditional:

Also,due of only consultIn18Decimals() is the function that is called for the protocol. Visibility to "consult" may be restricted. Change from "public" to "internal".