Oracle data feeds are insufficiently validated

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-asymmetry/blob/main/contracts/strategies/votium/VotiumStrategyCore.sol#L156-L186

Vulnerability details

Vulnerability Details

• In order to verify the Chainlink oracle data feeds response, Asymmetry utilizes the following logic, which could be improved to ensure the data feeds freshness:

  • // verify chainlink response
    if (
        (!_validate ||
            (cl.success == true &&
                cl.roundId != 0 &&
                cl.answer >= 0 && 
                cl.updatedAt != 0 &&
                cl.updatedAt <= block.timestamp &&
                block.timestamp - cl.updatedAt <= 25 hours))
    ) {
        return uint256(cl.answer);
    } else {
        revert ChainlinkFailed();
    }  

Recommended Mitigation Steps

• Short term:

  • Replace cl.answer >= 0 with cl.answer > 0
  • In addition to block.timestamp - cl.updatedAt <= 25 hours ensure that the answer was computed in the last round by adding answeredInRound >= roundId

• Long term: N/A

Assessed type

Oracle

[elmutt]

thanks.

my understanding is that answeredInRound is deprecated: https://docs.chain.link/data-feeds/api-reference

we will add the other change tho

[elmutt]

https://github.com/asymmetryfinance/afeth/pull/157

[0xleastwood]

I'm not sure if updating cl.answer >= 0 to cl.answer > 0 is deservedly a medium severity issue. When would this even be the case?

[c4-judge]

0xleastwood marked the issue as primary issue

[Rassska]

@0xleastwood, very unlikely that the price will drop to 0. Anyways, agreed on the decision being made regarding the severity, since it looks more like an assertion over the sanity check.

[0xleastwood]

@0xleastwood, very unlikely that the price will drop to 0. Anyways, agreed on the decision being made regarding the severity, since it looks more like an assertion over the sanity check.

IIRC, non-functional oracles may return a negative value which should be validated but I think any non-negative values are acceptable values. Downgrading to QA.

[c4-judge]

0xleastwood changed the severity to QA (Quality Assurance)

[c4-judge]

0xleastwood marked the issue as grade-b