You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
No liveness checks are performed while retrieving oracle data. As a result, prices could
be outdated yet used anyways affecting deposits, borrows, repayments, and any other
source that relies on Chainlink’s prices.
The data retrieval from the rate conversion wrapper does not check the retrieved price
and the success condition. As a result, the PriceFeedWrapper.latestAnswer() could
return negative or invalid data yet used anyways across the market.
The mentioned function has the following implementation:
On the other hand, Auditor.assetPrice() is implemented as follows:
function assetPrice(IPriceFeed priceFeed) publicviewreturns (uint256) {
if (address(priceFeed) == BASE_FEED) return basePrice;
int256 price = priceFeed.latestAnswer();
if (price <=0) revertInvalidPrice();
returnuint256(price) * baseFactor;
}
The low level staticcall function has two returns, a boolean success and bytes
data. Currently, the decoded rate has no rules as the price has in assetPrice(). Also,
there are no checks that ensure that the boolean return is true.
Recommendation
Check both the boolean return and the retrieved rate if possible.
The text was updated successfully, but these errors were encountered:
Offchain oracle response liveliness not checked.
No liveness checks are performed while retrieving oracle data. As a result, prices could
be outdated yet used anyways affecting deposits, borrows, repayments, and any other
source that relies on Chainlink’s prices.
The data retrieval from the rate conversion wrapper does not check the retrieved price
and the success condition. As a result, the
PriceFeedWrapper.latestAnswer()
couldreturn negative or invalid data yet used anyways across the market.
The mentioned function has the following implementation:
On the other hand, Auditor.assetPrice() is implemented as follows:
The low level staticcall function has two returns, a boolean success and bytes
data. Currently, the decoded rate has no rules as the price has in assetPrice(). Also,
there are no checks that ensure that the boolean return is true.
Recommendation
Check both the boolean return and the retrieved rate if possible.
The text was updated successfully, but these errors were encountered: