Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Fees for chainlink

petersr

Summary

Fees for chainlink are paid by using the native address, but this could be different on different chains.

Vulnerability Details

Since this protocol will be running on top of Arbitrum and then on another chain, this could lead to inconsistencies. Additionally, if the team decides to run the protocol on Ethereum, Ether will be used for paying the fees, and currently, there is no receive function.

function getEthVericationFee(
IVerifierProxy chainlinkVerifier,
bytes memory reportData
)
internal
returns (FeeAsset memory fee)
{
IFeeManager chainlinkFeeManager = chainlinkVerifier.s_feeManager();
address feeTokenAddress = chainlinkFeeManager.i_nativeAddress();
(fee,,) = chainlinkFeeManager.getFeeAndReward(address(this), reportData, feeTokenAddress);
}

Impact

This vulnerability could cause inconsistencies and failed transactions when the protocol runs on different chains, particularly between Arbitrum and Ethereum. The absence of a receive function for Ether payments on Ethereum could lead to transaction failures and potential loss of funds. This inconsistency can degrade user experience, reduce trust in the protocol, and complicate scalability and security assessments.

Tools Used

Manual review

Recommendations

Consider using the Link tokens for paying fees. This could be achieved by changing

function getEthVericationFee(
IVerifierProxy chainlinkVerifier,
bytes memory reportData
)
internal
returns (FeeAsset memory fee)
{
IFeeManager chainlinkFeeManager = chainlinkVerifier.s_feeManager();
+ address feeTokenAddress = chainlinkFeeManager. i_linkAddress();
- address feeTokenAddress = chainlinkFeeManager.i_nativeAddress();
(fee,,) = chainlinkFeeManager.getFeeAndReward(address(this), reportData, feeTokenAddress);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.