search

code-423n4 / 2022-03-rolla-findings

1 stars 1 forks source link

Using deprecated Chainlink function latestAnswer #9

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-03-rolla/blob/efe4a3c1af8d77c5dfb5ba110c3507e67a061bdd/quant-protocol/contracts/pricing/oracle/ChainlinkOracleManager.sol#L120

Vulnerability details

Proof of Concept

According to Chainlink's documentation, the latestAnswer function is deprecated. This function does not error if no answer has been reached but returns 0. Besides, the latestAnswer is reported with 18 decimals for crypto quotes but 8 decimals for FX quotes (See Chainlink FAQ for more details). A best practice is to get the decimals from the oracles instead of hard-coding them in the contract.

Recommended Mitigation Steps

Use the latestRoundData function to get the price instead. Add checks on the return data with proper revert messages if the price is stale or the round is uncomplete, for example:

(uint80 roundID, int256 price, , uint256 timeStamp, uint80 answeredInRound) = aggregator.latestRoundData();
require(answeredInRound >= roundID, "...");
require(timeStamp != 0, "...");
quantizations commented 2 years ago

Duplicate of #17