Whenever Chainlink's latestRoundData for any reason returns some not recent, but positive price, it will be used as current price by Cvx3CrvOracle's peek and get despite there will be no confirmation for it.
This way an attacker can monitor Chainlink oracle state and act on a stale price observation, knowing that stale 3CRV/ETH figure will be used in the system.
This kind of mispricing induced attacks tend to yield a partial loss of contract funds.
Handle
hyh
Vulnerability details
Impact
Whenever Chainlink's
latestRoundData
for any reason returns some not recent, but positive price, it will be used as current price by Cvx3CrvOracle'speek
andget
despite there will be no confirmation for it.This way an attacker can monitor Chainlink oracle state and act on a stale price observation, knowing that stale 3CRV/ETH figure will be used in the system.
This kind of mispricing induced attacks tend to yield a partial loss of contract funds.
Proof of Concept
_peek ignore price state Oracle data:
https://github.com/code-423n4/2022-01-yield/blob/main/contracts/Cvx3CrvOracle.sol#L120-127
Recommended Mitigation Steps
The fix is to check both reply’s round number to be recent and it's timestamp to be updated:
Now:
To be: