JPEG'd contest - pedroais's results

Lines of code

https://github.com/code-423n4/2022-04-jpegd/blob/e72861a9ccb707ced9015166fbded5c97c6991b6/contracts/vaults/NFTVault.sol#L212

Vulnerability details

Impact

Wrong interest can be charged if interest is changed without calling accrue()

Proof of Concept

The function setDebtInterestApr() updates the interest charged on debt without calling accrue() before to compute previous interests. If someone takes debt at 2% and after 1 month no one accrues and interest is changed to 5% user will pay 5% interest for the past month while the interest was 2%

Recommended Mitigation Steps

call accrue() in the beginning of setDebtInterestApr()

Lines of code

https://github.com/code-423n4/2022-04-jpegd/blob/e72861a9ccb707ced9015166fbded5c97c6991b6/contracts/vaults/NFTVault.sol#L459

Vulnerability details

Impact

Price returned by oracle could be stale

Proof of Concept

The use of aggregator.latestAnswer() is deprecated and could lead to stale data if the data wasn't recently updated. This is especially important for checking NFT prices since prices can change quickly it's critical to always check data was updated

Recommended Mitigation Steps

Use aggregator.latestRoundData() to get the price and check if the data is stale and the round is incomplete

(uint80 roundID, int256 price, , uint256 timeStamp, uint80 answeredInRound) = aggregator.latestRoundData(); require(answeredInRound >= roundID, "..."); require(timeStamp != 0, "...");