Liquidity Management

Summary

The contract relies on Chainlink price feeds for market data validation. If the price feed is compromised, delayed, or manipulated, it could lead to incorrect price validation, resulting in unfair liquidations or suboptimal trades.

Vulnerability Details

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/KeeperProxy.sol#L155-L180

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/KeeperProxy.sol#L188-L198

PoC:

• An attacker manipulates the Chainlink price feed for a token, causing it to report an artificially low or high price.

• The _validatePrice function uses the manipulated price to validate market prices, leading to incorrect execution of keeper actions.

• Example:

  (, int chainLinkPrice, , uint256 updatedAt, ) = AggregatorV2V3Interface(dataFeed[token]).latestRoundData();
  require(updatedAt > block.timestamp - maxTimeWindow[token], "stale price feed");
  require(
  _absDiff(price, chainLinkPrice.toUint256()) * BPS / chainLinkPrice.toUint256() < priceDiffThreshold[token],
  "price offset too big"
  );

  If chainLinkPrice is manipulated, the validation will pass even with incorrect prices.

Impact

Incorrect price validation could lead to financial losses, unfair liquidations, and protocol instability.

Tools Used

Chatgpt

Recommendations

• Use multiple independent price oracles to validate prices and reduce reliance on a single source.

• Implement price deviation checks to detect and respond to anomalies.

• Add a grace period for price updates to account for potential delays.