Algo Ssstablecoinsss
AI First Flight #2
Beginner FriendlyDeFi
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

[L-02] `liquidate()` accepts unregistered collateral tokens, producing opaque reverts instead of clean errors

webrainsec

Description

liquidate() passes the collateral address directly to _get_token_amount_from_usd without checking token_address_to_price_feed[collateral] != empty(address). An unregistered token creates AggregatorV3Interface(address(0)) and the staticcall produces an opaque revert with no useful error message.

Vulnerability Details

# dsc_engine.vy:112
@external
def liquidate(collateral: address, user: address, debt_to_cover: uint256):
# @> No check that collateral is a registered token
assert debt_to_cover > 0, "DSCEngine__NeedsMoreThanZero"

Compare with _deposit_collateral (line 219-221) which validates:

assert self.token_address_to_price_feed[token_collateral_address] != empty(
address
), "DSCEngine__TokenNotAllowed"

Recommendations

@external
def liquidate(collateral: address, user: address, debt_to_cover: uint256):
+ assert self.token_address_to_price_feed[collateral] != empty(address), "DSCEngine__TokenNotAllowed"
assert debt_to_cover > 0, "DSCEngine__NeedsMoreThanZero"
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 3 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!