hats-finance / StakeWise-0xd91cd6ed6c9a112fdc112b1a3c66e47697f522cd

Liquid staking protocol for Ethereum
Other
0 stars 0 forks source link

potential failing oracles on insufficient minimum oracles #113

Open hats-bug-reporter[bot] opened 1 year ago

hats-bug-reporter[bot] commented 1 year ago

Github username: @0xmahdirostami Submission hash (on-chain): 0x4bde07b0762937ed65abdd3f28302a3ebd55b73b51e1f6d736e6b9d9daa6fc64 Severity: low

Description: Description\

As mentioned in https://github.com/stakewise/v3-core/blob/main/audits/08-2023-Sigma-Prime.pdf STW-12, there are "potential failing oracles on insufficient minimum oracles" and this is addressed by using 6 out of 11 oracles for Rewards update and 8 out of 11 oracles for Validator(s) registration, BUT there isn't any check in _setRewardsMinOracles and _setValidatorsMinOracles.

Impact\

Describe above and in Sigma-Prime.pdf

Attachments

  1. Proof of Concept (PoC) File

  2. Revised Code File (Optional)

    
    -    if (_rewardsMinOracles == 0 || totalOracles < _rewardsMinOracles) {
    +    if (_rewardsMinOracles < 11 || totalOracles < _rewardsMinOracles) {
0xmahdirostami commented 1 year ago

Revised Code File (Optional)

using 6 out of 11 oracles for Rewards update
-    if (_rewardsMinOracles == 0 || totalOracles < _rewardsMinOracles) {
+    if (_rewardsMinOracles < 6|| totalOracles < _rewardsMinOracles) {

using  8 out of 11 oracles for Validator(s) registration
-    if (_validatorsMinOracles == 0 || totalOracles < _validatorsMinOracles) {
+    if (_validatorsMinOracles < 8 || totalOracles < _validatorsMinOracles) {
tsudmi commented 1 year ago

The rewardsMinOracles and validatorsMinOracles should stay configurable