Inverse Finance contest - joestakey's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L121

Vulnerability details

Market uses the Oracle.getPrice() functions to compute the credit limits and withdrawal limits of users. Given that dola has 18 decimals, this function reverts here if the token has more than 18 decimals, effectively breaking the markets that use this token as collateral.

Impact

Medium

Proof Of Concept

Oracle.getPrice() is called by liquidate, borrow and forceReplenish, either directly or via internal helpers. All these functions would revert in the case described above.

The operator can bypass this by setting a fixedPrice[token], but a fixed price used on a volatile asset has its own risks, as it can lead to under-collateralized loans in Market.

Tools Used

Manual Analysis

Mitigation

Either update the computation to take into account tokens with more than 18 decimals, or ensure markets are created for collateral tokens with 18 decimals or less.

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L116

Vulnerability details

Market uses the Oracle.getPrice() functions to compute the credit limits and withdrawal limits of users. This function gets the price of a specific token in DOLA. The issue is that is using a deprecated Chainlink function: latestAnswer(). This can break key Market functions, such as borrow and liquidate.

Impact

Medium

Proof Of Concept

latestAnswer() can return zero under certain circumstances, instead of reverting. In such cases:

• getWithdrawalLimitInternal would revert here
• liquidate would revert here
• getCollateralValueInternal() would return zero, making forceReplenish() revert here, borrow() revert here

The operator can bypass this by setting a fixedPrice[token], but a fixed price used on a volatile asset has its own risks, as it can lead to a under-collateralized loans in the market.

Tools Used

Manual Analysis

Mitigation

Use a more up-to-date function of ChainLink API, such as latestRoundData

You can also prevent the price from being set to zero:

+126:             if(normalizedPrice != 0 && normalizedPrice < todaysLow) {
-126:             if(todaysLow == 0 || normalizedPrice < todaysLow) {
127:                 dailyLows[token][day] = normalizedPrice;
128:                 todaysLow = normalizedPrice;
129:                 emit RecordDailyLow(token, normalizedPrice);
130:             }