ParaSpace contest - seyni's results

Lines of code

https://github.com/code-423n4/2022-11-paraspace/blob/c6820a279c64a299a783955749fdc977de8f0449/paraspace-core/contracts/misc/ParaSpaceOracle.sol#L128

Vulnerability details

Impact

ParaSpaceOracle uses latestAnswer in getAssetPrice. The documentation state that source could be "chainlink or other sources".

The price could be fine if it has already been validated by a source and then retrieved using source.latestAnswer(). But, if source is chainlink for which latestAnswer is deprecated it might lead to this issues:

• Deprecated API stops working.
• Price could not be obtained silently because the function doesn't revert but return 0 on failure.

This would lead for the protocol to stop operating and needing to be redeployed.

Proof of Concept

https://docs.chain.link/data-feeds/price-feeds/api-reference#accesscontrolledoffchainaggregator

ParaSpaceOracle.sol#L128

            price = uint256(source.latestAnswer());

Tools Used

Manual review.

Recommended Mitigation Steps

I recommend using latestRoundData instead of latestAnswer with added checks of price freshness.