Unexpected behavior from the _validateAndGetPrice function's failure to validate the oracleVersion and updateData inputs

Summary

The "Lack of Input Validation in _validateAndGetPrice Function" highlights a vulnerability in the contract's _validateAndGetPrice function, which lacks input validation for the oracleVersion and updateData parameters. Failing to validate inputs can lead to unexpected behavior or vulnerabilities.

Vulnerability Detail

The vulnerability arises from the _validateAndGetPrice function's failure to validate the oracleVersion and updateData inputs. Without proper validation, these inputs can be manipulated or provided with malicious data, potentially leading to errors or vulnerabilities in the contract.

Impact

The lack of input validation in the _validateAndGetPrice function can have various negative impacts, including:

Unexpected behavior due to invalid or malicious inputs.
Vulnerabilities that could be exploited by malicious actors to manipulate contract state or cause undesired behavior.
Difficulty in debugging and identifying the source of issues when invalid inputs are encountered.

Code Snippet

function _validateAndGetPrice(uint256 oracleVersion, bytes calldata updateData) private returns (PythStructs.Price memory price) {
    bytes[] memory updateDataList = new bytes[](1);
    updateDataList[0] = updateData;
    bytes32[] memory idList = new bytes32[](1);
    idList[0] = id;

    // ...
}

https://github.com/sherlock-audit/2023-09-perennial/blob/main/perennial-v2/packages/perennial-oracle/contracts/pyth/PythOracle.sol#L209

Tool used

Manual Review

Recommendation

To mitigate the lack of input validation in the _validateAndGetPrice function, follow these recommended steps:

Validate oracleVersion: Implement a check to ensure that oracleVersion is within a valid range and adheres to the contract's expected format. You can use require statements to enforce these checks.
```
require(oracleVersion > 0, "Invalid oracle version");
require(oracleVersion <= current(), "Future oracle versions not supported");
// Add additional validation as needed
```
Validate updateData: Implement checks to validate the format and content of updateData. Depending on the expected format and content, you may need to perform more specific validation.
```
require(updateData.length > 0, "Empty update data");
// Add additional validation for updateData as needed
```

By implementing these recommendations and adding input validation checks for both oracleVersion and updateData, you can enhance the security and reliability of the contract. Proper input validation helps prevent unexpected behavior and vulnerabilities resulting from invalid or malicious inputs.

sherlock-audit / 2023-09-perennial-judging

0xVinylDavyl - Unexpected behavior from the _validateAndGetPrice function's failure to validate the oracleVersion and updateData inputs #19