Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Function checks the wrong token in the `KeeperProxy::_validatePrice` function

kirobrejka

Summary

Function checks the wrong token in the KeeperProxy::_validatePrice function

Vulnerability Details

This happens due to the following checks:

function _validatePrice(
address perpVault,
MarketPrices memory prices
) internal view {
// L2 Sequencer check
(
,
/*uint80 roundID*/ int256 answer,
uint256 startedAt /*uint256 updatedAt*/ /*uint80 answeredInRound*/,
,
​
) = AggregatorV2V3Interface(sequencerUptimeFeed).latestRoundData();
bool isSequencerUp = answer == 0;
require(isSequencerUp, "sequencer is down");
// Make sure the grace period has passed after the sequencer is back up.
uint256 timeSinceUp = block.timestamp - startedAt;
require(timeSinceUp > GRACE_PERIOD_TIME, "Grace period is not over");
​
address market = IPerpetualVault(perpVault).market();
IVaultReader reader = IPerpetualVault(perpVault).vaultReader();
MarketProps memory marketData = reader.getMarket(market);
​
_check(marketData.indexToken, prices.indexTokenPrice.min);
_check(marketData.indexToken, prices.indexTokenPrice.max);
//FIXME: Wrong checks here
@> _check(marketData.longToken, prices.indexTokenPrice.min);
@> _check(marketData.longToken, prices.indexTokenPrice.max);
_check(marketData.shortToken, prices.shortTokenPrice.min);
_check(marketData.shortToken, prices.shortTokenPrice.max);
}

The long token price should be checked against the long token min/max asset prices

Impact

This may result in bad reverts or improper price checks

Tools Used

Manual review

Recommendations

Check the min/max price of long token correctly

Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_validatePrice_no_check_for_longTokenPrice

Likelihood: None/Very Low, everytime the keeper send a price via run/runNextAction (sent by the Gamma keeper). Impact: Medium/High, does not check the longTokenPrice, it could go out of range. Keep in mind indexToken == longToken, an error from the keeper could be considered informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.