libratus - Depeg cannot be triggered if asset restores its peg after a short depeg

[sherlock-admin]

libratus

medium

Depeg cannot be triggered if asset restores its peg after a short depeg

Summary

Vault token can fall below strike price and then rise back up. Theoretically, it can happen for only a few blocks and the triggerDepeg function may not be called on the controller. Then, it will be impossible to trigger depeg after the price is restored.

Vulnerability Detail

triggerDepeg function can only succeed if the current asset price is below the strike price

       int256 price = getLatestPrice(premiumVault.token());

       if (int256(premiumVault.strike()) <= price)
           revert PriceNotAtStrikePrice(price);

Latest round value is used from chainlink to get the current price

        (uint80 roundID, int256 price, , , uint80 answeredInRound) = priceFeed
            .latestRoundData();

To perform a strike, the contract relies on calling triggerDepeg function during the de-peg event. However, if the event is short-lived and the peg restores quickly, the strike may not be executed. Let's say there is a background job that monitors prices and calls triggerDepeg. The job may fail to execute the call for a number of reasons:

• The job went down for that period of time or encountered networking issues
• Problems with the RPC endpoint
• Network is overloaded (not out of the question during black swan events)

By the protocol design, when de-peg happens, the epoch has to end. In practice, this may not always happen, because the protocol doesn't allow triggering depeg based on historic Chainlink values.

Impact

Hedge depositors may lose their rewards if triggerDepeg isn't called during a short de-peg event.

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Controllers/ControllerPeggedAssetV2.sol#LL64-L65C49

Tool used

Manual Review

Recommendation

Allow users to provide roundId to triggerDepeg function. Instead of making a Chainlink call to latestRoundData() use getRoundData(roundId) and validate that the round is within bounds of the epoch. Refer to Chainlink documentation:
https://docs.chain.link/data-feeds/historical-data/#historical-rounds

Duplicate of #422