Kelp DAO | rsETH - paritomarrr's results

Lines of code

https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTOracle.sol#L46 https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/LRTOracle.sol#L96

Vulnerability details

Description

In the LRTOracle smart contract, there is a vulnerability related to using unvalidated asset addresses in the price Oracle functions. Specifically, the getAssetPrice and updatePriceOracleFor functions do not perform adequate validation checks on the asset parameter, which can lead to potential issues and unexpected behaviour.

Impact

This vulnerability could lead to unexpected behaviour, transaction failures, and potential security risks due to using unvalidated asset addresses in price oracle operations, potentially affecting data integrity and user experience.

Proof of Concept

This vulnerability can result in undesirable behaviour or unexpected reverts if invalid or null asset addresses are used as inputs to these functions. The code did not originally perform checks to verify the validity of the asset parameter in the getAssetPrice and updatePriceOracleFor functions. This could potentially allow the use of invalid or null asset addresses.

function getAssetPrice(address asset) public view onlySupportedAsset(asset) returns (uint256) {
return IPriceFetcher(assetPriceOracle[asset]).getAssetPrice(asset);
}

function updatePriceOracleFor(address asset, address priceOracle) external onlyLRTManager 
onlySupportedAsset(asset) {
UtilLib.checkNonZeroAddress(priceOracle);
assetPriceOracle[asset] = priceOracle;
emit AssetPriceOracleUpdate(asset, priceOracle);
}

Tools Used

Manual Review

Recommended Mitigation Steps

function getAssetPrice(address asset) public view onlySupportedAsset(asset) returns (uint256) {
require(asset != address(0), "Invalid asset address"); // Check for valid asset address
return IPriceFetcher(assetPriceOracle[asset]).getAssetPrice(asset);
}

function updatePriceOracleFor(address asset, address priceOracle) external onlyLRTManager 
onlySupportedAsset(asset) {
require(asset != address(0), "Invalid asset address"); // Check for valid asset address
UtilLib.checkNonZeroAddress(priceOracle);
assetPriceOracle[asset] = priceOracle;
emit AssetPriceOracleUpdate(asset, priceOracle);
}

Assessed type

Oracle