Submission Details
Impact:
Likelihood:
Oracle Price Domain Not Validated Enables Invalid Zero or Extreme Values
Root + Impact
Description
-
Price feeds are expected to return values within a sane domain.
The oracle accepts zero or extreme values without validation, which can break downstream calculations.
// Root cause in the codebase with @> marks to highlight the relevant section
// StrataxOracle.sol
// @> No bounds check on price
prices[asset] = price;
Risk
Likelihood:
-
Occurs due to misconfiguration or operational mistakes.
Can be triggered during maintenance or testing.
Impact:
-
Division-by-zero risks or extreme valuation distortions.
Protocol operations may revert or behave unexpectedly.
Proof of Concept
oracle.setPrice(asset, 0);
deposit(); // downstream math fails or misprices
Recommended Mitigation
- remove this code
+ add this code
+ require(price > 0 && price < MAX_PRICE, "Invalid price");
Rewards breakdown
nSLOC
356This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.