Submission Details
Severity:
Stale Price Oracle Data in Fee Conversion
Summary
The MarketMakingEngine relies on Chainlink's price feed without checking the freshness of the data. This could lead to incorrect WETH conversions during fee distribution.
Vulnerability Details
// In FeeDistributionBranch.sol
function _convertUsdzToWeth(uint256 amount) internal {
(, int price,, ) = chainlinkFeed.latestRoundData();
// Missing timestamp check here
uint256 wethAmount = amount * uint256(price) / 1e8;
// Proceed with conversion...
}
Impact
Stale prices could result in:
Over/underpayment to LPs (direct financial loss)
Incorrect USDz backing calculations (protocol insolvency risk)
Tools Used
Manual review
Slither (static analysis)
Recommendations
function _convertUsdzToWeth(uint256 amount) internal {
(uint80 roundID, int price, , uint256 timestamp, uint80 answeredInRound) = chainlinkFeed.latestRoundData();
require(block.timestamp - timestamp < 1 hours, "Stale price");
require(answeredInRound >= roundID, "Stale round");
require(price > 0, "Invalid price");
uint256 wethAmount = amount * uint256(price) / 1e8;
// Continue...
}
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.