Summary

The contract relies on Chainlink price feeds for accurate market data. If the price feed is compromised or experiences delays, it could lead to incorrect position valuations or liquidations.

Vulnerability Details

for example in the line of code

The contract relies on a single oracle (IOracle(oracle).getPrimaryPrice) to fetch prices. If this oracle is compromised or delayed, the prices returned could be incorrect, leading to incorrect position valuations or liquidations.

• Proof of Concept (PoC):

  • An attacker manipulates the Chainlink price feed, causing the contract to open or close positions at incorrect prices.

  • A delay in the price feed during high volatility results in outdated pricing, leading to suboptimal trades.

Impact

High. Incorrect pricing could lead to financial losses, unfair liquidations, and protocol instability.

Tools Used

Recommendations

• Use multiple independent price oracles to validate prices and reduce reliance on a single source.

• Implement price deviation checks to detect and respond to anomalies.

• Add a grace period for price updates to account for potential delays.