Zaros Part 1

Summary

Vulnerability Details

The SettlementConfiguration::verifyOffchainPrice() is called during order settlement, it verifies the provided input priceData on-chain, by sending an external call to chainlink verifier proxy contract. This proxy contract required a verification fee to process the verification, as can be seen below,

the contract using the native ETH as a fee.

The issue here is that the core fillMarketOrder() and fillOffchainOrders() functions internally uses the .verifyReport() function. Neither of these function have the payable modifier, and the contract also doesn't have any receive/fallback() function to pay for the verification cost.

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/SettlementBranch.sol#L107

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/branches/SettlementBranch.sol#L186

Due to the insufficient fee balance, the call to the verifier contract reverts, along with the entire order filling txn.

Impact

Users orders cannot be filled further

Tools Used

Manual review

Recommendations

Add a payable modifier to the filMarketOrder() and fillOffchainOrders()