Inverse Finance contest - Jujic's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/DBR.sol#L349

Vulnerability details

Impact

Allows operator to mint unlimited amount ADR tokens to any address

Proof of Concept

https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/DBR.sol#L349-L352

function mint(address to, uint amount) public {
        require(minters[msg.sender] == true || msg.sender == operator, "ONLY MINTERS OR OPERATOR");
        _mint(to, amount);
    }

Recommended Mitigation Steps

Set the minters as immutable to provide stronger security guarantees

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L82

Vulnerability details

Impact

The Chainlink API (latestAnswer) used in the Oracle contract is deprecated:

Please see API Reference for the latest Price Feed API. Chainlink Docs

Proof of Concept

uint price = feeds[token].feed.latestAnswer();

Tools Used

Recommended Mitigation Steps

Use the latestRoundData function to get the price instead. Add checks on the return data with proper revert messages if the price is stale or the round is uncomplete, for example:

(uint80 roundID, int256 price, , uint256 timeStamp, uint80 answeredInRound) = feeds[token].feed.latestRoundData();
require(answeredInRound >= roundID, "...");
require(timeStamp != 0, "...");