Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Incorrect Price Validation for Long Token in `KeeperProxy::_validatePrice` Function

kvltbyte

Summary

The marketData.longToken is incorrectly being invalidated in KeeperProxy::_validatePrice function potentially allowing invalid price values for marketData.longToken.

Vulnerability Details

In KeeperProxy::_validatePrice function there are checks to validate the prices of market tokens against Chainlink data feeds. This check is done by calling the _check function and passing the market price of each token and the corresponding minimum/maximum price that the token should have. However, the price of marketData.longTokenis incorrectly validated against MarketPrices.indexTokenPrice instead of MarketPrices.longTokenPrice.

_check(marketData.indexToken, prices.indexTokenPrice.min);
_check(marketData.indexToken, prices.indexTokenPrice.max);
@> _check(marketData.longToken, prices.indexTokenPrice.min);// Incorrect validation
@> _check(marketData.longToken, prices.indexTokenPrice.max);// Incorrect validation
_check(marketData.shortToken, prices.shortTokenPrice.min);
_check(marketData.shortToken, prices.shortTokenPrice.max);

Impact

Incorrect validation of longToken prices could lead to invalid values that fall outside the range of MarketPrice.longTokenPrice.min and MarketPrice.longTokenPrice.max.

Tools Used

  1. Manual review

Recommendations

  1. Fix the Price Validation Logic:

    Update the KeeperProxy_validatePrice function to correctly validate the long token's price using prices.longTokenPrice instead of prices.indexTokenPrice.

_check(marketData.indexToken, prices.indexTokenPrice.min);
_check(marketData.indexToken, prices.indexTokenPrice.max);
- _check(marketData.longToken, prices.indexTokenPrice.min);
- _check(marketData.longToken, prices.indexTokenPrice.max);
+ _check(marketData.longToken, prices.longTokenPrice.min);
+ _check(marketData.longToken, prices.longTokenPrice.max);
_check(marketData.shortToken, prices.shortTokenPrice.min);
_check(marketData.shortToken, prices.shortTokenPrice.max);
Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_validatePrice_no_check_for_longTokenPrice

Likelihood: None/Very Low, everytime the keeper send a price via run/runNextAction (sent by the Gamma keeper). Impact: Medium/High, does not check the longTokenPrice, it could go out of range. Keep in mind indexToken == longToken, an error from the keeper could be considered informational.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!