Submission Details
Severity:
The `addTokenMaxDeviation` function enables the owner to set a maximum price deviation
Summary
The addTokenMaxDeviation function enables the owner to set a maximum price deviation. Unauthorized changes to this setting may lead to overly permissive deviation levels, making the oracle less reliable.
Vulnerability Details
function addTokenMaxDeviation(address token, uint256 maxDeviation) external onlyOwner {
if (token == address(0)) revert Errors.ZeroAddressNotAllowed();
if (feeds[token] == address(0)) revert Errors.NoTokenPriceFeedAvailable();
if (maxDeviation < 0) revert Errors.TokenPriceFeedMaxDeviationMustBeGreaterOrEqualToZero();
maxDeviations[token] = maxDeviation;
}
Impact
As attackers can set overly permissive deviation levels, making the oracle less reliable. This could result in incorrect or manipulated price data being reported, which can lead to financial losses for users and applications relying on accurate price information.
Recommended Mitigation Steps
Vulnerable
function addTokenMaxDeviation(address token, uint256 maxDeviation) external onlyOwner {
if (token == address(0)) revert Errors.ZeroAddressNotAllowed();
if (feeds[token] == address(0)) revert Errors.NoTokenPriceFeedAvailable();
if (maxDeviation < 0) revert Errors.TokenPriceFeedMaxDeviationMustBeGreaterOrEqualToZero();
maxDeviations[token] = maxDeviation;
}
Recommended
// Add this modifier to the contract
modifier onlyOwnerOrAuthorized() {
require(msg.sender == owner() || msg.sender == authorizedAddress, "Not the owner or an authorized address");
_;
}
// Set an authorized address
address public authorizedAddress;
// Function to set the authorized address
function setAuthorizedAddress(address _authorizedAddress) external onlyOwner {
authorizedAddress = _authorizedAddress;
}
// Modify the addTokenMaxDeviation function to include access control
function addTokenMaxDeviation(address token, uint256 maxDeviation) external onlyOwnerOrAuthorized {
require(token != address(0), "Token address cannot be zero");
require(feeds[token] != address(0), "No token price feed available");
require(maxDeviation >= 0, "Token price feed max deviation must be greater or equal to zero");
maxDeviations[token] = maxDeviation;
}
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
2,28915 USDC / LOC
33,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.