Algo Ssstablecoinsss
AI First Flight #2
Beginner FriendlyDeFi
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: low
Invalid

Oracle Library Fails to Validate `price > 0` or Min/Max Aggregator Circuit Breaker Bounds

tinykitten

Summary

  • oracle_lib._stale_check_latest_round_data() converts the Chainlink price (int256) to uint256 without verifying that price > 0 or checking against aggregator minAnswer/maxAnswer boundaries.

  • If a price feed reports a zero or negative value, downstream calculations divide by zero or underflow, causing unexpected reverts in all valuation functions.

  • During extreme market volatility where price reaches the aggregator circuit breaker limits, the protocol continues trading at pegged limit prices.

Vulnerability Details

Description

In oracle_lib.vy, the returned price is checked for staleness, but its numeric value is never validated:

(
round_id, price, started_at, updated_at, answered_in_round
) = staticcall price_price.latestRoundData()
​
assert updated_at != 0, "DSCEngine_StalePrice"
assert answered_in_round >= round_id, "DSCEngine_StalePrice"
seconds_since: uint256 = block.timestamp - updated_at
assert seconds_since <= TIMEOUT, "DSCEngine_StalePrice"
@> return (round_id, price, started_at, updated_at, answered_in_round)

In dsc_engine.vy, _get_token_amount_from_usd uses this price as the denominator:

@internal
@view
def _get_token_amount_from_usd(
token: address, usd_amount_in_wei: uint256
) -> uint256:
...
@> return (
(usd_amount_in_wei * PRECISION) // (
convert(price, uint256) * ADDITIONAL_FEED_PRECISION
)
)

If price <= 0, convert(price, uint256) either triggers a runtime error or division by zero, preventing liquidations. Furthermore, if a market crash drops an asset's real price below Chainlink's minAnswer, the aggregator continues reporting minAnswer, causing the protocol to overvalue collateral during black swan events.

Risk

Likelihood: Low

  • Occurs during severe market flash-crashes or oracle misconfigurations where price bounds are reached or non-positive values are emitted.

Impact: High

  • Division by zero freezes liquidation capabilities during market crashes; circuit-breaker caps cause collateral overvaluation and unbacked debt minting.

Severity: Medium

Proof of Concept

If an aggregator returns price = 0:

  1. Calling get_token_amount_from_usd() causes integer division by zero: (usd_amount_in_wei * PRECISION) // 0.

  2. Liquidators cannot liquidate positions, leading to protocol bad debt.

Recommended Mitigation

Add explicit checks ensuring price > 0 and verify that the reported price does not match the aggregator's minAnswer or maxAnswer circuit-breaker boundaries:

assert updated_at != 0, "DSCEngine_StalePrice"
assert answered_in_round >= round_id, "DSCEngine_StalePrice"
+ assert price > 0, "DSCEngine_InvalidPrice"

Explanation: Reverting on non-positive or bounded prices protects downstream calculations from division by zero and prevents overvalued collateral execution during extreme market events.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!