Steadefi

Summary

The ChainlinkARBOracle.sol contract allows the owner to set Chainlink price feeds for specific tokens using the addTokenPriceFeed function. However, this can be exploited by malicious users who could replace the legitimate price feeds with their own, potentially reporting incorrect token prices.

Vulnerability Details

The vulnerability lies in the addTokenPriceFeed function, which allows the owner to set Chainlink price feeds for specific tokens without appropriate access controls. This function should be updated to include access controls to prevent unauthorized calls.

Vulnerable Code (ChainlinkARBOracle.sol):

Impact

The impact of this vulnerability is significant, as it can lead to erroneous token pricing. Malicious users can replace legitimate Chainlink price feeds with their own, potentially causing financial losses and disrupting the proper functioning of the oracle.

Tools Used

Manual

Recommendations

Access Control:
Adding proper access controls to the addTokenPriceFeed function to restrict its usage to authorized addresses. In this example, we'll use a modified version of the Ownable contract from OpenZeppelin.

Introduced an authorizedAddress and a setAuthorizedAddress function, allowing the owner to designate additional addresses that can call restricted functions. Consider implementing multi-signature requirements for critical functions like setting price feeds. This adds an extra layer of security by requiring multiple parties to approve changes. You can also add time lock mechanisms that impose a delay between initiating a price feed change and its execution. This provides an opportunity for users to identify and prevent unauthorized changes.