Open sherlock-admin2 opened 5 months ago
1 comment(s) were left on this issue during the judging contest.
panprog commented:
valid medium, the attacker will have to commit requested along with unrequested which might not be easy to do due to competition
The protocol team fixed this issue in the following PRs/commits: https://github.com/equilibria-xyz/perennial-v2/pull/293
The Lead Senior Watson signed off on the fix.
bin2chen
medium
ChainlinkFactory will pay non-requested versions keeper fees
Summary
Protocol definition:
Requested versions will pay out a keeper fee, non-requested versions will not.
But ChainlinkFactory ignoresnumRequested
, which pays for both.Vulnerability Details
Protocol definition:
Requested versions will pay out a keeper fee, non-requested versions will not.
commit()
->_handleKeeperFee()
->_applicableValue()
ChainlinkFactory._applicableValue ()
implements the following:The above method ignores the first parameter
numRequested
. This way, whether it isRequested versions
or not, you will paykeeper fees
. Violatingnon-requested versions will not pay
Impact
If
non-requested versions
will pay as well, it is easy to maliciously submitnon-requested
maliciously consumeChainlinkFactory
fees balance (Note that needs at least one numRequested to call_handleKeeperFee()
)Code Snippet
https://github.com/sherlock-audit/2024-02-perennial-v2-3/blob/main/perennial-v2/packages/perennial-oracle/contracts/chainlink/ChainlinkFactory.sol#L71
Tool used
Manual Review
Recommendation
It is recommended that only
Requested versions
keeper fees'