Phuture Finance contest - jah's results

Crypto index platform, that simplifies your investments through automated, themed index products.

General Information

Platform: Code4rena

Start Date: 19/04/2022

Pot Size: $30,000 USDC

Total HM: 10

Participants: 43

Period: 3 days

Judges: moose-code, JasoonS

Total Solo HM: 7

Id: 90

League: ETH

Phuture Finance

Findings Distribution

Researcher Performance

Rank: 39/43

Findings: 1

Award: $22.05

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository Phuture Finance

Findings Information

🌟 Selected for report: cccz

Also found by: 0xkatana, Dravee, IllIllI, WatchPug, berndartmueller, defsec, fatima_naz, jah, kebabsec, kenta, pedroais, peritoflores, rayn, reassor, tabish

Awards

22.0499 USDC - $22.05

Labels

bug

duplicate

2 (Med Risk)

External Links

Link to GitHub issue

Lines of code

https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/ChainlinkPriceOracle.sol#L83-#L84

Vulnerability details

Impact

The conctract uses latestRoundData but there is no check if the returned value is stale data or not

Proof of Concept

https://github.com/code-423n4/2021-12-perennial-findings/issues/24 https://github.com/code-423n4/2021-06-tracer-findings/issues/73#

Tools Used

Manual analysis

Recommended Mitigation Steps

Consider adding missing checks for stale data.

#0 - olivermehr
2022-05-02T20:00:59Z

Duplicate of #1

Phuture Finance contest - jah's results

Crypto index platform, that simplifies your investments through automated, themed index products.

General Information

Findings Distribution

Researcher Performance

External Links

[M-02] latestRoundData might return stale - $22.05

Findings Information

Awards

Labels

External Links

Lines of code

Vulnerability details

Impact

Proof of Concept

Tools Used

Recommended Mitigation Steps

#0 - olivermehr2022-05-02T20:00:59Z

#0 - olivermehr
2022-05-02T20:00:59Z