First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of fallbacks for price feed Oracles

oxenzo

Description:

The KittyFi protocol does not implement fallback solutions for price feed oracle. In case Chainlink's aggregators fail to update price data, the protocol will refuse to liquidate users' positions, leading to the protocol's disruption.

The KittyFi protocol utilizes the latestRoundData() for querying price data of collateral tokens through [Chainlink's price feed aggregators]. Nonetheless, if Chainlink's aggregators fail to update the price data, the KittyFi protocol will not be able to operate.

function getUserVaultMeowllateralInEuros(address _user) external view returns (uint256) {
​
@> (, int256 collateralToUsdPrice, , , ) = i_priceFeed.latestRoundData();
@> (, int256 euroPriceFeedAns, , ,) = i_euroPriceFeed.latestRoundData();
​
uint256 collateralAns = getUserMeowllateral(_user).mulDiv(uint256(collateralToUsdPrice) * EXTRA_DECIMALS, PRECISION);
return collateralAns.mulDiv(uint256(euroPriceFeedAns) * EXTRA_DECIMALS, PRECISION);
}
​
function getTotalMeowllateralInAave() public view returns (uint256) {
​
(uint256 totalCollateralBase, , , , , ) = i_aavePool.getUserAccountData(address(this));
​
@> (, int256 collateralToUsdPrice, , , ) = i_priceFeed.latestRoundData();
return totalCollateralBase.mulDiv(PRECISION, uint256(collateralToUsdPrice) * EXTRA_DECIMALS);
}
​

Impact:

Without fallback solutions, the KittyFi protocol will be unable to operate if Chainlink's aggregators fail to update price data.

Consider the scenario that Chainlink's aggregators fail to update price data and collateral tokens' prices dramatically go down, the DSC protocol will refuse to liquidate users' positions. Consequently, the protocol will become insolvent eventually, leading to the protocol's disruption.

Tools Used:

Manual Review.

Recommended Mitigation:

Implement fallback solutions, such as using other off-chain oracle providers and/or on-chain Uniswap's TWAP, for feeding price data in case Chainlink's aggregators fail.

Updates

Lead Judging Commences

shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Appeal created

oxenzo Submitter
about 1 year ago
shikhar229169 Lead Judge
about 1 year ago
oxenzo Submitter
about 1 year ago
shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.