code-423n4 / 2024-05-munchables-findings

3 stars 1 forks source link

The way you update the price of a token is wrong, because you don't use the price directly from an Oracle. #386

Closed howlbot-integration[bot] closed 5 months ago

howlbot-integration[bot] commented 5 months ago

Lines of code

https://github.com/code-423n4/2024-05-munchables/blob/main/src/managers/LockManager.sol#L142-L174

Vulnerability details

Impact

Token prices will not be updated correctly.

Proof of Concept

https://github.com/code-423n4/2024-05-munchables/blob/main/src/managers/LockManager.sol#L142-L174

Recommended Mitigation Steps

You should use an Oracle like Chainlink(https://docs.chain.link/data-feeds/using-data-feeds) to get the price of the tokens.

Assessed type

Oracle