Skip to content
This repository has been archived by the owner on Oct 1, 2023. It is now read-only.

Delvir0 - Insufficient Chainlink feed validation #126

Closed
sherlock-admin opened this issue Mar 27, 2023 · 4 comments
Closed

Delvir0 - Insufficient Chainlink feed validation #126

sherlock-admin opened this issue Mar 27, 2023 · 4 comments
Labels
Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label Escalation Resolved This issue's escalations have been approved/rejected Medium A valid Medium severity issue Reward A payout will be made for this issue

Comments

@sherlock-admin
Copy link
Contributor

sherlock-admin commented Mar 27, 2023 •
edited by hrishibhat
Loading

Delvir0

medium

Insufficient Chainlink feed validation

Summary

ControllerPeggedAssetV2.getLatestPrice has insufficient Chainlink feed validation

Vulnerability Detail

Since there is insufficient check for stale prices, a stablecoin could depeg and return to peg if while not being pickup due to stale prices.
While pegOracle does implement a check on this, it's not sufficient: https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/oracles/PegOracle.sol#L79 (not sure if this contract is going to be used).

Impact

Users that deposited a premium will not receive assets according to projects mechanism/ concept at depeg or other project economics could result in a loss.

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Controllers/ControllerPeggedAssetV2.sol#L313-L315

Tool used

Manual Review

Recommendation

Implement the solution that has been provided in previous audit code-423n4/2022-09-y2k-finance-findings#61

Duplicate of #70
@github-actions github-actions bot closed this as completed Apr 3, 2023
@github-actions github-actions bot added the Excluded Excluded by the judge without consulting the protocol or the senior label Apr 3, 2023
@sherlock-admin sherlock-admin added the Non-Reward This issue will not receive a payout label Apr 11, 2023
@Delvir0
Copy link

Delvir0 commented Apr 13, 2023

Escalate for 10 USDC
Duplicate of #70

@sherlock-admin
Copy link
Contributor Author

Escalate for 10 USDC
Duplicate of #70

You've created a valid escalation for 10 USDC!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

@sherlock-admin sherlock-admin added the Escalated This issue contains a pending escalation label Apr 13, 2023
@hrishibhat
Copy link

Escalation accepted

Duplicate of #70

@sherlock-admin
Copy link
Contributor Author

Escalation accepted

Duplicate of #70

This issue's escalations have been accepted!

Contestants' payouts and scores will be updated according to the changes made on this issue.

@sherlock-admin sherlock-admin added Escalation Resolved This issue's escalations have been approved/rejected Medium A valid Medium severity issue Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label Reward A payout will be made for this issue and removed Escalated This issue contains a pending escalation Non-Reward This issue will not receive a payout Excluded Excluded by the judge without consulting the protocol or the senior labels Apr 27, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label Escalation Resolved This issue's escalations have been approved/rejected Medium A valid Medium severity issue Reward A payout will be made for this issue
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@hrishibhat @sherlock-admin @Delvir0