Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Missing Signature Verification in Price Feed Handling

0xdaxun

Summary

The UsdTokenSwapKeeper contract forwards unvalidated price reports to marketMakingEngine.fulfillSwap(), allowing potential injection of malicious price data.

Vulnerability Details

File: UsdTokenSwapKeeper.sol
Lines: 121-128

function performUpkeep(bytes calldata performData) external override onlyForwarder {
(bytes memory signedReport, bytes memory extraData) = abi.decode(performData, (bytes, bytes));
(address user, uint128 requestId) = abi.decode(extraData, (address, uint128));
self.marketMakingEngine.fulfillSwap(user, requestId, signedReport, address(self.marketMakingEngine));
}

The contract blindly trusts signedReport without performing cryptographic validation of the report's authenticity. This violates Chainlink's recommended pattern where nodes should verify reports before processing.

Impact

  • Direct Losses: Malicious forwarders could manipulate swap prices

  • Protocol Insolvency: Systematic under/over-valuation of positions

  • Severity: High

Tools Used

  • Manual code review

  • Chainlink documentation cross-check

Recommendations

  1. Implement signature verification:

import "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
​
bytes32 reportHash = keccak256(signedReport);
address signer = ECDSA.recover(reportHash, signature);
require(isAuthorizedSigner(signer), "Invalid signer");

  1. Adopt Chainlink's validateReport pattern

  2. Add price staleness checks:

uint256 reportTimestamp = abi.decode(signedReport, (uint256));
require(block.timestamp - reportTimestamp < MAX_REPORT_AGE, "Stale report");
Updates

Lead Judging Commences

inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

0xdaxun Submitter
6 months ago
inallhonesty Lead Judge
6 months ago
inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.