Submission Details
Severity:
Inaccurate check for `answer` in `_badChainlinkResponse`
Summary
The validation for answer in _badChainlinkResponse is not accurate.
Vulnerability Details
Since the answer is a int type, if the answer is negative should also be consider as the part of the non-positive price and return true.
Impact
Mis-handling when return value is negative.
Tools Used
Manual
Recommendations
// Check for non-positive price
if (response.answer <= 0) { return true; }
Updates
Lead Judging Commences
hans almost 2 years ago
Submission Judgement Published Assigned finding tags:
Chainlink oracle answer can be negative
Very low likelihood -> evaluate the severity to LOW
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
2,28915 USDC / LOC
33,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.