BadgerDAO ibBTC Wrapper contest - leastwood's results

Handle

leastwood

Vulnerability details

Impact

The live ibBTC price for each share is cached to reduce gas costs of mint, burn and transfer operations. The updatePricePerShare() function is intended to be called on a regular interval, however, there is no incentive that this value is regularly updated. Hence, the functions within the WrappedIbbtcEth.sol contract may operate on outdated/old values for pricePerShare.

Proof of Concept

https://github.com/code-423n4/2021-10-badgerdao/blob/main/contracts/WrappedIbbtcEth.sol#L72-L77

Tools Used

Manual code review

Recommended Mitigation Steps

Consider integrating Chainlink keepers to further incentivize price updates through regular upkeeps. Alternatively, this can be implemented internally, using Badger tokens as a form of payment for work done with upkeeps.