The Standard

Summary

The distributeAssets function does not check for the minimum/maximum prices when calling Chainlink's price feed.

Vulnerability Details

Chainlink price feeds have in-built minimum & maximum prices they will return; if during a flash crash, bridge compromise, or depegging event, an asset’s value falls below the price feed’s minimum price, the oracle price feed will continue to report the (now incorrect) minimum price.

Impact

The distributeAssets function will operate on invalid data if called when the price of the tokens is outside the bounds of the provided maximum/minimum values of the price feed.

Tools Used

Manual Review

Recommendations

To help mitigate such an attack on-chain, smart contracts could check that minAnswer < receivedAnswer < maxAnswer.