QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of Price Range(Min/Max) Validation for Chainlink Oracle(ETH/USD) in Optimism Chain

0xaadi

Summary

The ChainlinkOracle contract does not validate the price data retrieved from Chainlink oracles against predefined minimum and maximum price thresholds. This oversight can result in the use of incorrect values if, during volatile market conditions or unexpected events, an asset’s price falls below the minimum threshold of the price feed.

Vulnerability Details

The following code in ChainlinkOracle contract use ETH/USD feed of Chainlink in Optimism

function _getData() internal view override returns (int216, uint40) {
(, /*uint80 roundID*/ int data, , /*uint startedAt*/ uint timestamp, ) = /*uint80 answeredInRound*/
priceFeed.latestRoundData();
require(data > 0, "INVLDDATA");
data = data * int(10 ** normalizationFactor);
return (int216(data), uint40(timestamp)); // Overflow of data is extremely improbable and uint40 is large enough for timestamps for a very long time
}

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/ChainlinkOracle.sol#L27C1-L33C6

And the following code is used to set ETH/USD oracle

function setETHUSDOracle(address _ethUsdOracle) public {
require(msg.sender == quantammAdmin, "ONLYADMIN");
ethOracle = OracleWrapper(_ethUsdOracle);
emit ETHUSDOracleSet(_ethUsdOracle);
}

https://github.com/Cyfrin/2024-12-quantamm/blob/a775db4273eb36e7b4536c5b60207c9f17541b92/pkg/pool-quantamm/contracts/UpdateWeightRunner.sol#L304C1-L308C6

In Optimism chain, the ETH/USD oracle and its aggregator, which returns a minimum answer (1000000000) and a maximum answer (100000000000000).

However, the code lacks a check to ensure that the returned answer falls within the range defined by the minimum and maximum values.

Impact

The code may operate using prices that do not accurately reflect current market values, potentially leading to financial losses for users during the process of adding liquidity or removing liquidity of ETH token in a pool.

Tools Used

Manual Review

Recommendations

Implement validation checks for minAnswer and maxAnswer when using Chainlink ETH/USD oracle in Optimism. Transactions should be restricted if the reported price hits these thresholds.

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

invalid_chainlink_min_max_no_check

LightChaser: ## [Low-25] Chainlink answer is not compared against min/max values

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.