Submission Details
Severity:
INCORRECT_POSITIVE_TOKEN_PRICE_CHECK
Summary
Bad response checking that is intended to check price is not negative actually checks price is not 0
Vulnerability Details
Chainlink returns price in int256 type. Check for the correct chainlink response should check it's not negative like described in comment. However it's only checked that value is not 0:
function _badChainlinkResponse(ChainlinkResponse memory response) internal view returns (bool) {
...
// Check for non-positive price
if (response.answer == 0) { return true; }
Impact
Negative price can be used in the protocol
Tools Used
Recommendations
Use check if (response.answer <= 0) { return true; }
Updates
Lead Judging Commences
hans over 1 year ago
Submission Judgement Published Assigned finding tags:
Chainlink oracle answer can be negative
Very low likelihood -> evaluate the severity to LOW
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
2,28915 USDC / LOC
33,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.