Inverse Finance contest - 8olidity's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol#L121

Vulnerability details

Impact

function setFeed(address token, IChainlinkFeed feed, uint8 tokenDecimals) public onlyOperator { feeds[token] = FeedData(feed, tokenDecimals); }

There is no restriction on tokenDecimals. If the sum of tokenDecimals and feedDecimals is greater than 36, it will overflow and cause the oracle function to fail

uint8 decimals = 36 - feedDecimals - tokenDecimals;

Proof of Concept

// src/test/FiRMTest.sol
oracle.setFeed(address(WETH), IChainlinkFeed(address(ethFeed)), 19); // @audit 18 -> 19

Tools Used

forge

Recommended Mitigation Steps

Limit the size of tokenDecimals

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol#L82

Vulnerability details

Impact

The contract uses Chainlink’s deprecated API latestAnswer(). Such functions might suddenly stop working if Chainlink stopped supporting deprecated APIs.

Deprecated API stops working. Prices cannot be obtained. Protocol stops and contracts have to be redeployed.

See similar Low-severity finding L11 from OpenZeppelin's Audit of Opyn Gamma Protocol: https://blog.openzeppelin.com/opyn-gamma-protocol-audit/

This was a Medium-severity finding even in the previous version of WildCredit contest as well: code-423n4/2021-07-wildcredit-findings#75 where it was reported that "latestAnswer method will return the last value, but you won’t be able to check if the data is fresh. On the other hand, calling the method latestRoundData allow you to run some extra validations”

See https://docs.chain.link/docs/deprecated-aggregatorinterface-api-reference/#latestanswer.

Proof of Concept

interface IChainlinkFeed {
    function decimals() external view returns (uint8);
    function latestAnswer() external view returns (uint);
}

Tools Used

Recommended Mitigation Steps

calling the method latestRoundData allow you to run some extra validations