Inverse Finance contest - idkwhatimdoing's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol#L112-L144

Vulnerability details

Impact

If getPrice is never called for 2 days, the price will be directly from the feed

Recommended Mitigation Steps

Consider reverting getPrice if previous day low is missing. Create a separate function to update low price separately.

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol#L82 https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol#L116

Vulnerability details

Impact

The token price is obtained using Chainlink feed. However, the timestamp associated with the price data is not verified; therefore it is possible to use a stale token price.

Proof of Concept

    (uint80 roundID, int256 price, , uint256 timeStamp, uint80 answeredInRound) = oracle.latestRoundData();
    require(answeredInRound >= roundID, "...");
    require(timeStamp != 0, "...");

Recommended Mitigation Steps

Instead of using deprecated method latestAnswer, use latestRoundData to obtain price. Add checks on the return data with proper revert messages if the price is stale or the round is incomplete.