Steadefi

Summary

All calls to ChainlinkARBOracle.consultIn18Decimals will revert if the deviation param of the token is not scaled to SAFE_MULTIPLIER (1e18) when added to the vault.

Vulnerability Details

SteadeFi uses the mapping named maxDeviation in the ChainlinkARBOracle to check whether the price of a token has changed more than needed between 2 chainlink responses.

The root cause of the problem is in the addTokenMaxDeviation function which sets the max deviation factor of a given token:

As we can see the number used is not scaled, instead of it relies on the user input directly, and when consultIn18Decimals function is called it will check if there is a bad price deviation implemented that way:

That will result in everytime when _badPriceDeviation is called it will result in true, which will make the functions using it to revert, DOS-sing this core functions of the GMXVault:

• Deposit

• Withdraw

• tokenWeights

And will require multiSig owner to have 2 signatures in order to change the deviation to an appropriate number.

Impact

DOS-sing of the core functions by deployer mistake

Tools Used

Manual

Recommendations

When adding the token to the maxDeviation mapping scale the maxDeviation of the appropriate decimals of the token.