Steadefi

Summary

ChainlinkARBOracle._badChainlinkResponse validates negative prices.

Vulnerability Details

• ChainlinkARBOracle._badChainlinkResponse function is intended to check the response returned by the oracle aggregators if it's valid or not based on the response success, roundId, response timestamp and the returned price if equals to zero; and it returns true if the oracle response is invalid & false if the response is valid:

  function _badChainlinkResponse(ChainlinkResponse memory response) internal view returns (bool) {

  // Check for response call reverted

  if (!response.success) { return true; }

  // Check for an invalid roundId that is 0

  if (response.roundId == 0) { return true; }

  // Check for an invalid timeStamp that is 0, or in the future

  if (response.timestamp == 0 || response.timestamp > block.timestamp) { return true; }

  // Check for non-positive price

  if (response.answer == 0) { return true; }

  ​

  return false;

  }

• But as can be noticed; if the response.answer (which is of int256 type) is a negative value; this will bypass the check and return false indicating that the response is valid!

• And since this function is used indirectly in the consult function; then this function will return corrupted/invalid token price.

Impact

This will affect all the accounting/calculations of the protocol with the negative invalid value returned by the oracle.

Proof of Concept

ChainlinkARBOracle._badChainlinkResponse function/L118-L119

ChainlinkARBOracle.ChainlinkResponse struct

Tools Used

Manual Review.

Recommendations

Update ChainlinkARBOracle._badChainlinkResponse function to check for the negative price: