Value could be zero if answer < 100 in Oracle.sol#getUnderlyingPrice
Summary
The getUnderlyingPrice() function in the Oracle contract is vulnerable to returning a zero price when the value retrieved from the AggregatorV3Interface's latestRoundData() function is less than 100. This vulnerability can lead to incorrect price calculations and impact the accuracy of the protocol's functions that rely on accurate price feeds.
Vulnerability Detail
The vulnerability arises when the latestRoundData() function call returns a value less than 100 for the answer. In such cases, the function does not handle this scenario, and the subsequent division operation answer /= 100; can result in a zero price. This can lead to incorrect calculations and misrepresent the actual price of the underlying asset.
Impact
Incorrect valuation of assets based on underestimated prices. It is important to inform them that the possibility of the answer being less than 100 has become significantly low, but this factor should be considered when depegging the underlying asset.
To address this vulnerability, it is recommended to modify the getUnderlyingPrice() function to handle cases where the answer value is less than 100. One approach is to introduce a minimum threshold for the answer value and ensure it is above zero before performing the division operation. This can be achieved by changing the require statement with below code:
0xBugBuster
medium
Value could be zero if answer < 100 in Oracle.sol#getUnderlyingPrice
Summary
The
getUnderlyingPrice()function in the Oracle contract is vulnerable to returning a zero price when the value retrieved from the AggregatorV3Interface'slatestRoundData()function is less than100. This vulnerability can lead to incorrect price calculations and impact the accuracy of the protocol's functions that rely on accurate price feeds.Vulnerability Detail
The vulnerability arises when the
latestRoundData()function call returns a value less than100for the answer. In such cases, the function does not handle this scenario, and the subsequent division operationanswer /= 100;can result in a zero price. This can lead to incorrect calculations and misrepresent the actual price of the underlying asset.Impact
Incorrect valuation of assets based on underestimated prices. It is important to inform them that the possibility of the
answerbeing less than100has become significantly low, but this factor should be considered when depegging the underlying asset.Code Snippet
https://github.com/sherlock-audit/2023-04-hubble-exchange/blob/main/hubble-protocol/contracts/Oracle.sol#L35
Tool used
Manual Review
Recommendation
To address this vulnerability, it is recommended to modify the
getUnderlyingPrice()function to handle cases where the answer value is less than100. One approach is to introduce a minimum threshold for the answer value and ensure it is above zero before performing the division operation. This can be achieved by changing the require statement with below code:Duplicate of #99