The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

No Chainlink `latestRoundData()` return values sanity checks

amarfares

Vulnerability Details

The LiquidationPool.sol#distributeAssets() function uses Chainlink's latestRoundData() in order to determine the price of priceEurUsd, but there are no sanity checks whatsoever which could return very inaccurate results.

https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPool.sol#L207C1-L207C1

function distributeAssets(ILiquidationPoolManager.Asset[] memory _assets, uint256 _collateralRate, uint256 _hundredPC) external payable {
consolidatePendingStakes();
(,int256 priceEurUsd,,,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
uint256 stakeTotal = getStakeTotal();
uint256 burnEuros;
uint256 nativePurchased;
for (uint256 j = 0; j < holders.length; j++) {
...
}

priceEurUsd is later in the function used to determine the costInEuros, so if latestRoundData() returns stale and inaccurate results, users could be charged more/less than they should.

uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd)

Impact

Wrong price values for important variables

Tools Used

Manual Review

Recommendations

Implement sanity checks for latestRoundData():

(uint80 roundID ,uint256 answer, , uint256 timestamp, uint80 answeredInRound) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
​
require(answer > 0, "Chainlink price <= 0");
require(answeredInRound >= roundID, "Stale price");
require(block.timestamp <= timestamp + stalePriceDelay, Error.STALE_PRICE);
Updates

Lead Judging Commences

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Chainlink-price

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Chainlink-price

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!