Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Some tokens don't have USD feeds and won't be able to be used

SBSecurity

Summary

ChainlinkUtil library does not allow having a cross-oracle configuration and will not be able to work with a set of collateral types, defined in the Scope, as they don’t have direct USD-denominated price feeds.

  • wstETH

  • WEETH

All these don’t have USD price feed and can be verified there - https://docs.chain.link/data-feeds/price-feeds/addresses?network=arbitrum&page=1.

Vulnerability Details

Usage of these collateral types will not be possible since they have only ETH price feeds

Screenshot 2024-07-31 at 11.30.23 AM.png

Knowing that, Zaros perpetual will fail to configure the oracle for these two tokens since price is got directly and functionality to handle wstETH → ETH → USD conversion is missing:

ChainlinkUtil.sol

function getPrice(
IAggregatorV3 priceFeed,
uint32 priceFeedHeartbeatSeconds,
IAggregatorV3 sequencerUptimeFeed
)
internal
view
returns (UD60x18 price)
{
uint8 priceDecimals = priceFeed.decimals();
// should revert if priceDecimals > 18
if (priceDecimals > Constants.SYSTEM_DECIMALS) {
revert Errors.InvalidOracleReturn();
}
...MORE CODE
try priceFeed.latestRoundData() returns (uint80, int256 answer, uint256, uint256 updatedAt, uint80) {
if (block.timestamp - updatedAt > priceFeedHeartbeatSeconds) {
revert Errors.OraclePriceFeedHeartbeat(address(priceFeed));
}
​
IOffchainAggregator aggregator = IOffchainAggregator(priceFeed.aggregator());
int192 minAnswer = aggregator.minAnswer();
int192 maxAnswer = aggregator.maxAnswer();
​
if (answer <= minAnswer || answer >= maxAnswer) {
revert Errors.OraclePriceFeedOutOfRange(address(priceFeed));
}
​
price = ud60x18(answer.toUint256() * 10 ** (Constants.SYSTEM_DECIMALS - priceDecimals));
} catch {
revert Errors.InvalidOracleReturn();
}
}

Impact

Collateral types mentioned in the scope of this audit will not be available since they don’t have USD price feeds

Tools Used

Manual Review

Recommendations

getPrice should be extended to support price aggregation from 2 oracles, otherwise these collateral types will not be able to be used.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Some in-scope tokens don't have Chainlink feeds on Arbi

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.