Submission Details
Severity:
Calls to Oracles don't check for stale prices
Summary
Calls to Oracles don't check for stale prices.
Vulnerability Detail
None of the Oracle calls to check for stale prices, for example, LiquidationPool.distributeAssets():
(, int256 priceEurUsd, , , ) = Chainlink
.AggregatorV3Interface(eurUsd)
.latestRoundData();
Impact
Oracle price feeds can become stale due to a variety of reasons. Using a stale price will result in incorrect calculations in most of the key functionality of LiquidationPool & LiquidationPoolManager contracts.
Tool used
Manual Review
Recommendation
Read the updatedAt parameter from the calls to latestRoundData() and verify that it isn't older than a set amount, eg:
(, int256 priceEurUsd, , uint256 updatedAt, ) = Chainlink
.AggregatorV3Interface(eurUsd)
.latestRoundData();
if (updatedAt < block.timestamp - 60 * 60 /* 1 hour */) {
revert("stale price feed");
}
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
Chainlink-price
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.