First Flight #21: KittyFi

Summary

Calling latestRoundData() on the chainlink aggregator can potentially revert in some cases leading to Denial of service in certain aspects of the protocol like KittyVault::getUserMeowllateral, KittyVault::executeWhiskdrawal, KittyVault::getUserVaultMeowllateralInEuros and KittyVault::executeDepawsit

Vulnerability Details

Calls to the chainlink oracle pricefeeds could potentially revert, which may result in a complete Denial-of-Service to the protocol. Chainlink multisigs can immediately block access to price feeds at will. Hence, It is not a guarantee that the oracle will work 100% always so in the event that the oracle reverts, the protocol will be unusable to users.

Impact

• DoS

Tools Used

• manual review

• https://medium.com/cyfrin/chainlink-oracle-defi-attacks-93b6cb6541bf

• https://blog.openzeppelin.com/secure-smart-contract-guidelines-the-dangers-of-price-oracles

Recommendations

In KittyVault::getTotalMeowllateralInAave and KittyVault::getUserVaultMeowllateralInEuros, Wrap the i_priceFeed.latestRoundData() and i_euroPriceFeed.latestRoundData() function calls in the in a try catch block to handle possible unexpected oracle reverts.