The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Chainlink oracle will return the wrong price if the aggregator hits `minPrice` in `LiquidationPool::distributeAssets`

bube

Summary

Chainlink aggregators have a built-in circuit breaker if the price of an asset goes outside of a predetermined price band. The result is that if an asset experiences a huge drop in value (i.e. LUNA crash) the price of the oracle will continue to return the minPrice instead of the actual price of the asset and vice versa.

Vulnerability Details

The LiquidationPool::distributeAssets function uses Chainlink::latestRoundData() function to retrieve EUR/USD and Token/USD prices. When latestRoundData() is called it requests data from the aggregator. The aggregator has a minPrice and a maxPrice. If the price falls below the minPrice instead of reverting it will just return the min price.

​
function distributeAssets(ILiquidationPoolManager.Asset[] memory _assets, uint256 _collateralRate, uint256 _hundredPC) external payable {
consolidatePendingStakes();
@> (,int256 priceEurUsd,,,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
uint256 stakeTotal = getStakeTotal();
uint256 burnEuros;
uint256 nativePurchased;
for (uint256 j = 0; j < holders.length; j++) {
Position memory _position = positions[holders[j]];
uint256 _positionStake = stake(_position);
if (_positionStake > 0) {
for (uint256 i = 0; i < _assets.length; i++) {
ILiquidationPoolManager.Asset memory asset = _assets[i];
if (asset.amount > 0) {
@> (,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
.
.
.
}
}
}
}

Impact

If the price feed retrieved from Chainlink in LiquidationPool::distributeAssets for asset is incorrect due to the aggregator not updating the price below the minPrice, the contract would use this incorrect price to calculate the distribution of assets and the cost in EUROs. This could result in users receiving a disproportionate amount of assets for their stake, or the contract burning more EUROs than necessary, based on the inflated price.

Tools Used

Manual Review

Recommendations

Add the following checks after retrieving the price from Chainlink oracle:

// minPrice check
require(answer > minPrice, "Min price exceeded");
// maxPrice check
require(answer < maxPrice, "Max price exceeded");
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

chainlink-minanswer

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

chainlink-minanswer

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.