Closed code423n4 closed 1 year ago
GalloDaSballo marked the issue as primary issue
getVerifiedPrice()
would revert if price is invalid.
TriHaz marked the issue as sponsor disputed
Agree with th esponsor https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/utils/TradingLibrary.sol#L106-L107
require(_isNode[_provider], "!Node");
Logically equivalent to just using the priceData.price after validation, no risk was shown https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/TradingExtension.sol#L181-L182
_price = _priceData.price;
Could downgrade to QA, but am closing as invalid
GalloDaSballo marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/TradingExtension.sol#L88-L120
Vulnerability details
Impact
In the function
_limitClose
from theTradingExtension
contract the_priceData.price
is not verified with thegetVerifiedPrice
function instead its value is directly used, and because the thegetVerifiedPrice
internally calls the functionTradingLibrary.verifyPrice
which is responsible of verifying that the price is signed by a whitelisted node, the_limitClose
function can potentiely use a price that is not signed by a whitelisted node.This will cause problems in the
limitClose
function from theTrade
contract which calls_limitClose
, and it will affect the closing of the position.Proof of Concept
The issue occurs in the
_limitClose
function :File: contracts/TradingExtension.sol Line 88-120
As you can see from the code above the
getVerifiedPrice
function is called but its return value is not used instead the price is used directly from_priceData.price
.The
_limitClose
function will be called bylimitClose
function from theTrading
contract when trying to close a position at pre-set price :File: contracts/Trading.sol Line 565-576
Because the returned price
_limitPrice
from_limitClose
is calculated using non verified price it can cause issues when the_closePosition
function is called and user might lose funds.Tools Used
Manual review
Recommended Mitigation Steps
To avoid this issue the function
_limitClose
must use the verified price to calculate the limitPrice value, the_limitClose
function should be modified as follow :