search

sherlock-audit / 2023-12-flatmoney-judging

11 stars 9 forks source link

LTDingZhen - `OracleModule` is broken because there is no `RETH/USD` Chainlink oracle on Base chain #145

Closed sherlock-admin closed 8 months ago

sherlock-admin commented 8 months ago

LTDingZhen

high

OracleModule is broken because there is no RETH/USD Chainlink oracle on Base chain

Summary

Current OracleModule cannot behave normally on Base, because it relies on a oracle which follows interface IChainlinkAggregatorV3 and returns RETH/USD price feed.

Vulnerability Detail

According to Chainlink, image

There is only a RETH/ETH feed on Base, so OracleModule is bricked.

And, it is worth noting that even if RETH/ETH + ETH/USD is used, there would be more issue: RETH/ETH has a 24h heartbeat and ETH/USD has a 20min heartbeat, so the price would always be stale feed multiply fresh feed.

Impact

OracleModule cannot return correct price feed.

Code Snippet

https://github.com/sherlock-audit/2023-12-flatmoney/blob/main/flatcoin-v1/src/OracleModule.sol#L141-L157

Tool used

Manual Review

Recommendation

Use RETH/ETH and ETH/USD feed.

Duplicate of #90

sherlock-admin commented 8 months ago

1 comment(s) were left on this issue during the judging contest.

takarez commented:

invalid: