Skip to content

Latest commit

 

History

History
55 lines (34 loc) · 2.15 KB

076.md

File metadata and controls

55 lines (34 loc) · 2.15 KB

Elegant Arctic Stork

Medium

Insufficient Validation of Chainlink latestRoundData in getThePrice Function

Summary

The lack of validation for additional parameters returned by the Chainlink latestRoundData function will cause incorrect price usage for users and the protocol as the function may process stale or invalid data.

Root Cause

In DebitaChainlink.sol:30, the function getThePrice only checks the price value from the latestRoundData function without validating other critical parameters such as answeredInRound and updatedAt.

https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/376fec45be95bd4bbc929fd37b485076b03ab8b0/Debita-V3-Contracts/contracts/oracles/DebitaChainlink.sol#L30C1-L47C6

Examples:

  1. In DebitaChainlink.sol:30, the updatedAt timestamp is not checked, allowing stale price data to be used.
  2. In DebitaChainlink.sol:81, the answeredInRound value is not verified against roundId, which risks processing invalid or incomplete round data.

Internal pre-conditions

  1. A valid priceFeed address is set for the token.
  2. The isFeedAvailable status for the price feed is true.
  3. The contract is not paused (isPaused == false).

External pre-conditions

The Chainlink price feed provides stale or invalid data (e.g., updatedAt is old, or answeredInRound < roundId).

Attack Path

  1. A price feed set in the setPriceFeeds function provides stale or invalid data.
  2. The getThePrice function retrieves this data via latestRoundData().
  3. The function fails to validate the timestamp or round data and returns an inaccurate price.

Impact

The users and the protocol suffer an approximate loss of financial accuracy as the contract may calculate prices based on stale or invalid oracle data, leading to incorrect transactions or mispricing.

PoC

na

Mitigation

  1. Validate the answeredInRound and roundId fields to ensure the data corresponds to a valid round: 
    require(answeredInRound >= roundId, "Invalid round data");
  2. Validate the updatedAt field to ensure the data is not stale: 
    require(block.timestamp - updatedAt <= 1 hours, "Stale price data");