search

hats-finance / StakeWise-0xd91cd6ed6c9a112fdc112b1a3c66e47697f522cd

Liquid staking protocol for Ethereum
Other
0 stars 0 forks source link

Incorrect and incomplete Chainlink aggregator interface implemented for `PriceOracle` contract. #7

Open hats-bug-reporter[bot] opened 1 year ago

hats-bug-reporter[bot] commented 1 year ago

Github username: @akshaysrivastav Submission hash (on-chain): 0x1c2cbd9df087ef96d76619fe9e6806d7cb163565725f1ad40df61652a4ba37d1 Severity: medium

Description: Description\ The PriceOracle contract intends to implement the Chainlink aggregator interface, but it only implements the latestAnswer function.

There are two major issues in this implementation:

  1. The contract does not implement other crucial function of chainlink like latestRoundData, which breaks the compatibility of PriceOracle with contracts that expect a complete chainlink agregator interface.
  2. The implemented latestAnswer function is officially deprecated, see https://docs.chain.link/data-feeds/api-reference#latestanswer.

Attack Scenario\ The other contracts which expects a complete chainlink aggregator interface won't be able to interact with PriceOracle contract.

Mitigation Consider implementing the complete interface for chainlink as described at https://docs.chain.link/data-feeds/api-reference#functions-in-aggregatorv3interface

Attachments

  1. Proof of Concept (PoC) File Not needed.
tsudmi commented 1 year ago

Chainlink interface is implemented correctly: https://github.com/stakewise/v3-core/blob/main/contracts/osToken/PriceFeed.sol#L15