Closed code423n4 closed 2 years ago
Well, the Chainlink aggregators for DAI, USDC and USDT wrt ETH are 18 decimals.
The check that we are passing the right addresses should be done externally, as stated in the README.
I think both sides have a point here.
Personally my main observation is that the function using auth
ultimately shows a potential single point of failure / admin privilege.
Ultimately the sponsor can check before setting the oracles address which is in line with their requirement in the readme.
I'll mark the finding as invalid although the sponsor may want to consider hardcoding the chainlink price fees to provide further security guarantees to the protocol users
Handle
leastwood
Vulnerability details
Impact
Considering that the chainlink oracles used by the
Cvx3CrvOracle.sol
contract are expected to be denominated inETH
, I think it would be worthwhile to add a check insetSource
to ensureDAI.decimals()
,USDC.decimals()
andUSDT.decimals()
all return18
as their result.Proof of Concept
https://github.com/code-423n4/2022-01-yield/blob/main/contracts/Cvx3CrvOracle.sol#L36-L50
https://github.com/code-423n4/2022-01-yield/blob/main/contracts/Cvx3CrvOracle.sol#L120-L127
Tools Used
Manual code review.
Recommended Mitigation Steps
Consider implementing the suggestion above.