Submission Details
Severity:
Negative chainlink response not properly validated.
Summary
After consultation, the gotten chainlink response is checked to ensure that its not bad. One of requiments is that the response is not negative.
Vulnerability Details
In the _badChainlinkResponse() function,
// Check for non-positive price
if (response.answer == 0) { return true; }
This check is intended for negative price. As can be seen above, the response is only checked against 0 and not for values less than 0.
Impact
Tools Used
Manual code review
Recommendations
Change the check
if (response.answer <= 0) { return true; }
Updates
Lead Judging Commences
hans almost 2 years ago
Submission Judgement Published Assigned finding tags:
Chainlink oracle answer can be negative
Very low likelihood -> evaluate the severity to LOW
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
2,28915 USDC / LOC
33,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.