Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

validate oracle data properly #90

Closed
code423n4 opened this issue Aug 16, 2022 · 1 comment
Closed

validate oracle data properly #90

code423n4 opened this issue Aug 16, 2022 · 1 comment
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working duplicate This issue or pull request already exists invalid This doesn't seem right out of scope

Comments

@code423n4
Copy link
Contributor

Lines of code

https://github.com/code-423n4/2022-08-frax/blob/main/src/contracts/FraxlendPairCore.sol#L524
https://github.com/code-423n4/2022-08-frax/blob/main/src/contracts/FraxlendPairCore.sol#L532

Vulnerability details

Impact

You should check how recent the Chainlink Oracle's data is. Recently we had the UST oracle that was paused which some protocols didn't handle properly: https://ambcrypto.com/chainlink-how-a-price-discrepancy-resulted-in-millions-lost-from-defi-protocols/

Currently, you only check whether the price is 0 or negative. Here's Chainlink's documentation on risk mitigation

Tools Used

none

Recommended Mitigation Steps

At least verify that the data is recent. This depends on the oracle. They push updates at different time intervals.
@code423n4 code423n4 added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working labels Aug 16, 2022
code423n4 added a commit that referenced this issue Aug 16, 2022
@code423n4
Ruhum issue #90
0b4068b
@amirnader-ghazvini amirnader-ghazvini added the duplicate This issue or pull request already exists label Aug 29, 2022
@amirnader-ghazvini
Copy link
Collaborator

Duplicate of #179

@amirnader-ghazvini amirnader-ghazvini marked this as a duplicate of #179 Aug 29, 2022
@gititGoro gititGoro added invalid This doesn't seem right out of scope labels Sep 30, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working duplicate This issue or pull request already exists invalid This doesn't seem right out of scope
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@gititGoro @amirnader-ghazvini @code423n4