Storage Proofs

Summary

The function _extractParametersFromProof extracts storage slot values from a provided state proof. However, it does not perform sufficient validation to ensure the extracted values are within expected bounds, making the system vulnerable to incorrect or manipulated data being stored and used in price updates.

Vulnerability Details

• The function _extractParametersFromProof processes state proofs by iterating through a list of extracted storage slots.

• There are no explicit validation checks to ensure that the extracted values are within expected ranges or follow expected data formats.

• If an attacker submits a malformed or manipulated proof, the contract might extract and use incorrect values, leading to invalid price calculations.

• The contract assumes that the provided proof is always correct if it passes basic structural checks, without verifying the plausibility of extracted parameters.

Impact

• If an attacker submits an invalid or out-of-bounds value, the oracle could accept and store an incorrect price update.

• Users relying on the price feed might execute trades or lending operations based on manipulated data, resulting in financial loss.

• The incorrect price could propagate across multiple DeFi protocols, leading to systemic risks within the ecosystem.

Tools Used

manauly

Recommendations

• Implement strict validation checks for extracted storage values to ensure they match expected data types and fall within predefined ranges.

• Introduce sanity checks on extracted values before using them in price calculations.

• Implement logging and monitoring to detect anomalies in state proof extraction and reject suspicious inputs.