The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

0 returned `assetPriceUsd` from Chainlink can erode the worth of EUROs token.

zanybonzy

Summary

The assetPriceUsd is not checked for 0. A case like this could affect the value of costInEuros calculated which lead to underlying assets being distributed and corresponding EUROs tokens not being burned. Which affects the stability of the tokens, making the worth less as the underlying asset backing the token is being removed.

Vulnerability Details

In the distributeAssets function, assets are distributed for a price, and the correponding EUROs tokens are burned. When calculating the amount of EUROS to burn, we calculate by

uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd)
* _hundredPC / _collateralRate;

Note that the assetPriceUsd in use is retrieved from chainlink's AggregatorV3Interface, and can return 0. This be the currently returned price, due to the asset pricefeed not existing on chain, Chainlink's multisigs blocking access to the pricefeed.

(,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();

Consequently, the costInEuros parameter calculated will be 0.

A result of this is that the _position.EUROs and burnEuros will remain unchanged, but the underlying asset will be transferred.

​
function distributeAssets(ILiquidationPoolManager.Asset[] memory _assets, uint256 _collateralRate, uint256 _hundredPC) external payable {
...
_position.EUROs -= costInEuros; //@note
rewards[abi.encodePacked(_position.holder, asset.token.symbol)] += _portion;
burnEuros += costInEuros; //@note
if (asset.token.addr == address(0)) {
nativePurchased += _portion;
} else {
IERC20(asset.token.addr).safeTransferFrom(manager, address(this), _portion);
}
}
}
}
positions[holders[j]] = _position;
}
if (burnEuros > 0) IEUROs(EUROs).burn(address(this), burnEuros);
returnUnpurchasedNative(_assets, nativePurchased);
}
}

Impact

This affects protocol accounting, assets backing the EUROs tokens will be transfered without EUROs tokens burned, consequently reducing their value and making them worth less.

Tools Used

Manual Code Review

Recommendations

Include a check to ensure returned value is not 0

require(priceEurUsd > 0, "Chainlink price <= 0");
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

chainlink-revert

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

chainlink-revert

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.