Summary:
FeeConversionKeeper.sol
relies on Chainlink price feeds without checking for staleness, risking incorrect fee conversions.
Vulnerability Details:
The contract fetches the latest price using priceFeed.latestAnswer()
but does not validate the updatedAt
timestamp. If the feed is outdated (e.g., due to a Chainlink heartbeat delay), the keeper could convert fees using incorrect prices, leading to under/overvalued transactions.
Code Reference:
FeeConversionKeeper.sol (Lines 60-70):
Impact:
Stale prices could cause fees to be converted at unfavorable rates, resulting in financial losses for the protocol or users.
Recommendations:
Add a timestamp check to ensure the price is recent:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.