Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

No way to send ETH into the protocol, this causes `ChainlinkUtil.verifyReport` to revert since no ETH fee will be sent with the call

spearmint

Summary

ChainlinkUtil.verifyReport sends out ETH but the PerpsEngine contract does not hold ETH therefore it will always revert. The PerpsEngine contract does not implement a receive or fallback function to accept ETH.

Vulnerability Details

The code makes it obvious that a fee in ETH is sent with the call to the chainlinkVerifier contract.

Chainlink also stated clearly in their docs

You pay to verify reports from Data Streams onchain using the verifier contract. You pay per report verified. If you verify multiple reports in a batch, you pay for all of the reports included in that batch.
The verification price is 0.35 USD per report.

Here is the SettlementConfiguration.verifyDataStreamsReport() that calls ChainlinkUtil.verifyReport

function verifyDataStreamsReport(
DataStreamsStrategy memory dataStreamsStrategy,
bytes memory signedReport
)
internal
returns (bytes memory verifiedReportData)
{
IVerifierProxy chainlinkVerifier = dataStreamsStrategy.chainlinkVerifier;
​
bytes memory reportData = ChainlinkUtil.getReportData(signedReport);
(FeeAsset memory fee) = ChainlinkUtil.getEthVericationFee(chainlinkVerifier, reportData);
verifiedReportData = ChainlinkUtil.verifyReport(chainlinkVerifier, fee, signedReport);
}

Clearly a fee is calculated by calling getEthVericationFee and then passed into ChainlinkUtil.verifyReport

Taking a look now at ChainlinkUtil.verifyReport

function verifyReport(
IVerifierProxy chainlinkVerifier,
FeeAsset memory fee,
bytes memory signedReport
)
internal
returns (bytes memory verifiedReportData)
{
verifiedReportData = chainlinkVerifier.verify{ value: fee.amount }(signedReport, abi.encode(fee.assetAddress));
}

It sends the previously calcualted fee as ETH in the function call chainlinkVerifier.verify

The issue is that the PerpsEngine contract does not implement a receive or fallback function so that the protocol can send ETH to it

Impact

Keepers cannot fill orders since ChainlinkUtil.verifyReport always reverts

There is no way to send ETH into the contract to pay the verify report fee

Tools Used

Manual Review

Recommendations

Implement a receive function

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

No means for the PerpEngine to receive native to pay the Chainlink Verifier in case Chainlinks charges fees to the protocol

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.