Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Insufficient Chainlink Price Feed Validation

antoanrusinov

[MEDIUM-1] Insufficient Chainlink Price Feed Validation

Location

PerpetualVault.sol -> Multiple price feed integration points

Description

The implementation lacks crucial validations recommended by Chainlink's documentation:

  1. No check for negative prices

  2. Missing round completion validation

  3. Incomplete sequencer status validation for L2

Impact

  • Acceptance of stale or invalid prices

  • Potential system disruption from negative prices

  • Incorrect L2 sequencer status interpretation

Proof of Concept

contract ChainlinkValidationTest is Test {
PerpetualVault public vault;
MockAggregator public priceFeed;
function setUp() public {
vault = new PerpetualVault();
priceFeed = new MockAggregator();
}
function testInvalidPriceAcceptance() public {
// 1. Set negative price
priceFeed.setAnswer(-100);
// 2. Set different roundId and answeredInRound
priceFeed.setRoundData(2, -100, block.timestamp, block.timestamp, 1);
// 3. Verify price is accepted despite being invalid
assertTrue(vault.isPriceValid(), "Invalid price should be rejected");
}
}

Recommendation

Implement comprehensive price feed validation:

contract PerpetualVault {
function _validatePrice(AggregatorV3Interface priceFeed) internal view returns (uint256) {
(
uint80 roundId,
int256 answer,
uint256 startedAt,
uint256 updatedAt,
uint80 answeredInRound
) = priceFeed.latestRoundData();
require(answer > 0, "Negative price");
require(answeredInRound >= roundId, "Stale price");
require(updatedAt >= block.timestamp - maxPriceAge, "Stale price");
if (isL2) {
require(_isSequencerActive(), "Sequencer down");
}
return uint256(answer);
}
}
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.