The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`LiquidationPoolManager::distributeAssets()` Uses Deprecated Chainlink Function to Calculate `assetPriceFeed`

krisrenzo

Description:

The usage of deprecated Chainlink functions, such as latestRoundData(), might return stale or incorrect data, affecting the integrity of smart contracts. See here.

Impact:

If the price feed is inaccurate, the value for assetPriceUsd will be inaccurate, potentially causing overpricing or underpricing of assets, leading to a loss for either the protocol or stakers.

Proof of Concept:

Tools Used:

  • Manual review

Recommended Mitigation Steps:

Use the latestRoundData function to retrieve the price. Add checks on the return data with proper revert messages if the price is stale or the round is incomplete. For example:

(uint80 roundID, int256 assetPriceFeed, , uint256 timeStamp, uint80 answeredInRound) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
require(answeredInRound >= roundID, "...");
require(timeStamp != 0, "...");
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Chainlink-price

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Chainlink-price

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.