Notional contest - defsec's results

Handle

defsec

Vulnerability details

Impact

The contract uses Chainlink’s deprecated API latestAnswer(). Such functions might suddenly stop working if Chainlink stopped supporting deprecated APIs.

Impact: Deprecated API stops working. Prices cannot be obtained. Protocol stops and contracts have to be redeployed.

See similar Low-severity finding L11 from OpenZeppelin's Audit of Opyn Gamma Protocol: https://blog.openzeppelin.com/opyn-gamma-protocol-audit/

This was a Medium-severity finding even in the previous version of WildCredit contest as well: code-423n4/2021-07-wildcredit-findings#75 where it was reported that "latestAnswer method will return the last value, but you won’t be able to check if the data is fresh. On the other hand, calling the method latestRoundData allow you to run some extra validations”

Proof of Concept

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/utils/EIP1271Wallet.sol#L176

See https://docs.chain.link/docs/deprecated-aggregatorinterface-api-reference/#latestanswer.

Tools Used

Code Review

Recommended Mitigation Steps

Consider to add checks on the return data with proper revert messages if the price is stale or the round is incomplete, for example:

(uint80 roundID, int256 price, , uint256 timeStamp, uint80 answeredInRound) = ETH_CHAINLINK.latestRoundData();
require(price > 0, "Chainlink price <= 0");
require(answeredInRound >= roundID, "...");
require(timeStamp != 0, "...");

Handle

defsec

Vulnerability details

Impact

The setCoolDownTime function does not have any upper or lower bounds. Values that are too large will lead to reversions in several critical functions. User funds will be locked forever.

Proof of Concept

1. Navigate to the following contract.

https://github.com/code-423n4/2022-01-notional/blob/main/contracts/sNOTE.sol#L95

    function redeem(uint256 sNOTEAmount) external nonReentrant {
        AccountCoolDown memory coolDown = accountCoolDown[msg.sender];
        require(sNOTEAmount <= balanceOf(msg.sender), "Insufficient balance");
        require(
            coolDown.redeemWindowBegin != 0 &&
            coolDown.redeemWindowBegin < block.timestamp &&
            block.timestamp < coolDown.redeemWindowEnd,
            "Not in Redemption Window"
        );

        uint256 bptToRedeem = getPoolTokenShare(sNOTEAmount);
        _burn(msg.sender, bptToRedeem);

        BALANCER_POOL_TOKEN.safeTransfer(msg.sender, bptToRedeem);
    }

Tools Used

Code Review

Recommended Mitigation Steps

Ensure that coolDownPeriod has minimum/maximum bound.