Handle

leastwood

Vulnerability details

Impact

latestRoundData is missing additional validation to ensure that the round is complete and has returned a valid/expected price. This is documented here.

Proof of Concept

https://github.com/code-423n4/2022-01-yield/blob/main/contracts/Cvx3CrvOracle.sol#L120-L127

(, int256 daiPrice, , , ) = DAI.latestRoundData();
(, int256 usdcPrice, , , ) = USDC.latestRoundData();
(, int256 usdtPrice, , , ) = USDT.latestRoundData();

require(
    daiPrice > 0 && usdcPrice > 0 && usdtPrice > 0,
    "Chainlink pricefeed reporting 0"
);

Tools Used

Manual code review. Chainlink best practices.

Recommended Mitigation Steps

Consider validating the output of latestRoundData to match the following code snippet:

(
    uint80 roundID,
    int256 daiPrice,
    ,
    uint256 updateTime,
    uint80 answeredInRound
) = DAI.latestRoundData();
require(
    answeredInRound >= roundID,
    "Yield: Chainlink Price Stale"
);
require(daiPrice > 0, "Yield: Chainlink Malfunction");
require(updateTime != 0, "Yield: Incomplete round");

The same recommendation can be applied to the USDC.latestRoundData() and USDT.latestRoundData() calls.

code-423n4 / 2022-01-yield-findings