Submission Details
Severity:
The oracle return value from `latestRoundData()` is not validated
Summary
The oracle return value from latestRoundData() is not validated.
Vulnerability Details
The usage of the return values with latestRoundData is missing additional validations to ensure the price a valid/expected price and not staled.
Impact
Invalid or stale price may be used.
Tools Used
Manual
Recommendations
Adding addintional validation on the latestRoundData returns.
For example:
(uint80 roundID ,answer,, uint256 timestamp, uint80 answeredInRound) = AggregatorV3Interface(addr).latestRoundData();
require(answer > 0, "Chainlink price <= 0");
require(answeredInRound >= roundID, "Stale price");
require(timestamp != 0, "Round not complete");
// also back up oracle or stale price tolerance
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
Chainlink-price
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.