Summary
The distributeAssets function in LiquidationPool contract relies on the latest price data from Chainlink oracles to calculate the distribution of assets and the cost in EUROs. If the latestRoundData function returns stale or incorrect data, the calculations for asset distribution and pricing could be inaccurate. This could lead to incorrect distributions of assets, unfair pricing, and potential economic losses for users.
Vulnerability Details
The following lines of code are where the Chainlink latestRoundData function is called [Line number 207 and 218]. And it can miscalculate _portion, burnEuros and nativePurchased [in Line 223] and distribute the wrong amounts.
File: contracts/LiquidationPool.sol
205: function distributeAssets(ILiquidationPoolManager.Asset[] memory _assets, uint256 _collateralRate, uint256 _hundredPC) external payable {
206: consolidatePendingStakes();
207: @> (,int256 priceEurUsd,,,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
208: uint256 stakeTotal = getStakeTotal();
209: uint256 burnEuros;
210: uint256 nativePurchased;
211: for (uint256 j = 0; j < holders.length; j++) {
212: Position memory _position = positions[holders[j]];
213: uint256 _positionStake = stake(_position);
214: if (_positionStake > 0) {
215: for (uint256 i = 0; i < _assets.length; i++) {
216: ILiquidationPoolManager.Asset memory asset = _assets[i];
217: if (asset.amount > 0) {
218: @> (,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
219: uint256 _portion = asset.amount * _positionStake / stakeTotal;
220: uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd)
221: * _hundredPC / _collateralRate;
222: if (costInEuros > _position.EUROs) {
223: _portion = _portion * _position.EUROs / costInEuros;
224: costInEuros = _position.EUROs;
225: }
226: _position.EUROs -= costInEuros;
227: rewards[abi.encodePacked(_position.holder, asset.token.symbol)] += _portion;
228: burnEuros += costInEuros;
229: if (asset.token.addr == address(0)) {
230: nativePurchased += _portion;
231: } else {
232: IERC20(asset.token.addr).safeTransferFrom(manager, address(this), _portion);
233: }
234: }
235: }
236: }
237: positions[holders[j]] = _position;
238: }
239: if (burnEuros > 0) IEUROs(EUROs).burn(address(this), burnEuros);
240: returnUnpurchasedNative(_assets, nativePurchased);
241: }
242: }
https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPool.sol#L205C1-L218C124
Impact
The use of stale or incorrect oracle data can compromise the integrity of the contract's financial calculations and operations, potentially leading to financial discrepancies.
Tools Used
Manual Review
Recommendations
Implement additional checks to ensure the oracle data is fresh and within acceptable bounds. This could involve checking the timestamp of the last update and comparing it against the current block timestamp.
function distributeAssets(ILiquidationPoolManager.Asset[] memory _assets, uint256 _collateralRate, uint256 _hundredPC) external payable {
consolidatePendingStakes();
- (,int256 priceEurUsd,,,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
+ (,int256 priceEurUsd,,,uint256 updatedAt) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
+ require(block.timestamp - updatedAt < acceptableDelay, "Stale oracle data for EUR/USD"); // @audit Example of checking the timestamp from latestRoundData
uint256 stakeTotal = getStakeTotal();
uint256 burnEuros;
uint256 nativePurchased;
for (uint256 i = 0; i < _assets.length; i++) {
ILiquidationPoolManager.Asset memory asset = _assets[i];
if (asset.amount > 0) {
- (,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
+ (,int256 assetPriceUsd,,,uint256 assetUpdatedAt) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
+ require(block.timestamp - assetUpdatedAt < acceptableDelay, "Stale oracle data for asset"); // @audit Example of checking the timestamp from latestRoundData
Note: acceptableDelay is a variable that defines the maximum allowed delay (in seconds) for the oracle data to be considered fresh.
