ParaSpace contest - ujamal_'s results

The First Ever Cross-Margin NFT Financialization Protocol.

General Information

Platform: Code4rena

Start Date: 28/11/2022

Pot Size: $192,500 USDC

Total HM: 33

Participants: 106

Period: 11 days

Judge: LSDan

Total Solo HM: 15

Id: 186

League: ETH

ParaSpace

Findings Distribution

Researcher Performance

Rank: 101/106

Findings: 1

Award: $18.31

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

Awards

18.3064 USDC - $18.31

Labels

bug
2 (Med Risk)
satisfactory
duplicate-420

External Links

Lines of code

https://github.com/code-423n4/2022-11-paraspace/blob/main/paraspace-core/contracts/misc/ParaSpaceOracle.sol#L128

Vulnerability details

Impact

According to Chainlink’s documentation, the latestAnswer function is deprecated. This function might suddenly stop working if Chainlink stops supporting deprecated APIs. And the old API can return stale data. there is a _fallbackOracle present but still it will be better to use the latest version of api so that in case _fallbackOracle is not working or if condition is not satisfied, original oracle is retuning correct value.

https://docs.chain.link/docs/price-feeds-api-reference/

Proof of Concept

ParaSpaceOracle.sol#L128

Tools Used

Use the latestRoundData function of oracle to get the price instead.

#0 - c4-judge

2022-12-20T17:45:16Z

dmvt marked the issue as duplicate of #5

#1 - c4-judge

2023-01-09T16:34:37Z

dmvt marked the issue as partial-50

#2 - c4-judge

2023-01-23T15:56:07Z

dmvt marked the issue as full credit

#3 - c4-judge

2023-01-23T15:56:12Z

dmvt marked the issue as satisfactory

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter