Zaros Part 1

Summary

Zaros utilizes Chainlink Streams Lookup to perform the logic to fill orders, but the current implementation has a critical issue.

The project is not able to pay the necessary fee to verify the report provided by Chainlink.

According to the docs, to verify each report a fee of 0.35 cents is charged. https://docs.chain.link/data-streams/billing

Chainlink offers different options to pay those fees, it can be using the native token(ARB) LINK or other ERC20s listed on their website.

Zaros decided to implement the version with the native token, as it is shown here:

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/external/chainlink/ChainlinkUtil.sol#L95-L104

The problem is: the current contract that calls this function doesn't accept ETH, therefore msg.value is going to be always 0. This will make the transaction revert and cause a DoS to fillOffchainOrdersand fillMarketOrder

Vulnerability Details

Let's analyse from where the verifyReportis called:

fillMarketOrder/fillOffchainOrders-> verifyOffchainPrice-> verifyDataStreamsReport-> verifyReport

During this flow, no functions are marked payable therefore once the project is deployed on Arbitrum, the project will not be able to fill any order.

The sponsor, after the contest began, revealed that they have a "special" arrangement with Chainlink. However, this information was not disclosed as a Known Issue, and Chainlink does not mention the possibility of "special deals" with protocols.

Additionally, there is no "special" smart contract used in the project for the chainlink verifier. As a result, the current implementation is flawed because msg.value is passed as zero to the Chainlink verifier.

Impact

• The data stream will not provide the requested data. Causing DoS in the mechanism to fillOrders.

Tools Used

Manual Review

https://docs.chain.link/chainlink-automation/guides/streams-lookup

https://docs.chain.link/data-streams/billing

Recommendations

Mark the fillOrder functions as payable so the contract can receive ETH. Additionally, a check can be added to see whether the msg.value meets the necessary amount needed to verify a report.