Phuture Finance contest - tabish's results

Lines of code

https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/ChainlinkPriceOracle.sol#L80

Vulnerability details

Impact

Detailed description of the impact of this finding. Stale price from data feed can lead to incorrect value of assetPerBaseInUQ

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Oracle data feed is insufficiently validated. There is no check for stale price and round completeness.

    /// @inheritdoc IPriceOracle
    function refreshedAssetPerBaseInUQ(address _asset) public override returns (uint) {
        AssetInfo storage assetInfo = assetInfoOf[_asset];

        (, int basePrice, , , ) = baseAggregator.latestRoundData();
        (, int quotePrice, , , ) = assetInfo.aggregator.latestRoundData();

        require(basePrice > 0 && quotePrice > 0, "ChainlinkPriceOracle: NEGATIVE");

        uint assetPerBaseInUQ = ((uint(basePrice) * 10**assetInfo.decimals).mulDiv(
            FixedPoint112.Q112,
            (uint(quotePrice) * 10**baseDecimals)
        ) * 10**assetInfo.answerDecimals) / 10**baseAnswerDecimals;
        assetInfo.lastAssetPerBaseInUQ = assetPerBaseInUQ;
        return assetPerBaseInUQ;
    }

Recommended Mitigation Steps

Validate data feed

    /// @inheritdoc IPriceOracle
    function refreshedAssetPerBaseInUQ(address _asset) public override returns (uint) {
        AssetInfo storage assetInfo = assetInfoOf[_asset];
        
        (uint80 roundID, int basePrice, , uint256 timestamp, uint80 answeredInRound) = baseAggregator.latestRoundData();
        require(basePrice > 0, "ChainLink: base price <= 0");
        require(answeredInRound >= roundID, "ChainLink: Stale price");
        require(timestamp > 0, "ChainLink: Round not complete");

        (uint80 roundID, int quotePrice, , uint256 timestamp, uint80 answeredInRound) = assetInfo.aggregator.latestRoundData();
        require(quotePrice > 0, "ChainLink: asset price <= 0");
        require(answeredInRound >= roundID, "ChainLink: Stale price");
        require(timestamp > 0, "ChainLink: Round not complete");

        uint assetPerBaseInUQ = ((uint(basePrice) * 10**assetInfo.decimals).mulDiv(
            FixedPoint112.Q112,
            (uint(quotePrice) * 10**baseDecimals)
        ) * 10**assetInfo.answerDecimals) / 10**baseAnswerDecimals;
        assetInfo.lastAssetPerBaseInUQ = assetPerBaseInUQ;
        return assetPerBaseInUQ;
    }