Stader Labs - kutugu's results

Lines of code

https://github.com/code-423n4/2023-06-stader/blob/7566b5a35f32ebd55d3578b8bd05c038feb7d9cc/contracts/StaderOracle.sol#L646-L649

Vulnerability details

Impact

Not check the result's accuracy and freshness of the chainlink oracle, may use incorrect or stale price.

Proof of Concept

        (, int256 totalETHBalanceInInt, , , ) = AggregatorV3Interface(staderConfig.getETHBalancePORFeedProxy())
            .latestRoundData();
        (, int256 totalETHXSupplyInInt, , , ) = AggregatorV3Interface(staderConfig.getETHXSupplyPORFeedProxy())
            .latestRoundData();
        return (uint256(totalETHBalanceInInt), uint256(totalETHXSupplyInInt), block.number);

• Zero value may be returned when the oracle goes down, no checking. Assuming totalETHBalanceInInt is less than 0, this will simply change to uint256, which causes an error.
• Oracle may return stale result and the subsequent calculation value is stale and can be used.

Tools Used

Manual Review

Recommended Mitigation Steps

(uint80 roundID, int256 totalETHBalanceInInt, , uint256 timestamp, uint80 answeredInRound) = AggregatorV3Interface(staderConfig.getETHBalancePORFeedProxy()).latestRoundData();
require(totalETHBalanceInInt > 0, "totalETHBalanceInInt <= 0"); 
require(answeredInRound >= roundID, "Stale price");
require(timestamp != 0, "Round not complete");

Assessed type

Oracle