Closed c4-bot-4 closed 5 months ago
Seems to be an opinion more so than a valid finding
GalloDaSballo marked the issue as insufficient quality report
GalloDaSballo marked the issue as primary issue
Well documented behavior of WISE, closing as a recommendation submitted for High.
trust1995 marked the issue as unsatisfactory: Overinflated severity
Lines of code
https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/WiseOracleHub/OracleHelper.sol#L131-L174
Vulnerability details
Impact
The exact token price may not be returned.In
OracleHelper.sol#_validateAnswer
function, the price of the token was obtained from chainlink and uniswap twap, but ultimately only the price of chainlink was returned. Sinceuniswap twap
was not used in the resulting price calculation, the token price may be inaccurate.Proof of Concept
'OracleHepler.sol#_validateAnswer'function is as follows.
As you can see in 'L149-L151' and 'L173', only the chainlink price is returned in the function.
Tools Used
Manual Review
Recommended Mitigation Steps
Modify the
OracleHelper.sol#_validateAnswer
function as follows.Assessed type
Other