Submission Details
Severity:
Chainlink validations
Summary
Chainlink data basic validations are missing.
Vulnerability Details
The contract fetches Oracle data and only pays attention to the price, ignoring other parameters:
(,int256 priceEurUsd,,,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
(,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
Verifying results from Chainlink Oracle is always recommended, so it does not contain stale data or wrong values. You can read more here:
https://github.com/code-423n4/2021-10-mochi-findings/issues/87
Impact
The contract blindly accepts any results from the Oracle. A stale Oracle might cause incorrect distribution of the assets.
Tools Used
Manual review.
Recommendations
Verify Oracle data, e.g.
require(answeredInRound >= roundID, "...");
require(timeStamp != 0, "...");
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
Chainlink-price
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.