fulfillSwap function will always revert because no msg.value is being sent to the Chainlink verifier
Summary
The StabilityBranch:fulfillSwap function (Github link) fails to properly handle Chainlink offchain price verification as it's not marked as payable, causing all swap fulfillment attempts to revert.
Vulnerability Details
The fulfillSwapfunction is designed to process Chainlink Functions responses for price verification, but lacks the payable modifier. This function will call StabilityConfiguration.verifyOffchainPrice, which in turn calls ChainlinkUtil.verifyReport.
The verifyReport function calls chainlinkVerifier.verify which requires a msg.value to be attached to the transaction. As fulfillswap is not a payable function, it is not possible to send a value to chainlink, so the function call will always revert.
Impact
All calls to fulfillSwap will revert, effectively bricking the contract's functionality.
Tools Used
Manual Review
Recommendations
Add apayablemodifier to fulfillSwap.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.