min and maxAnswer never checked for oracle price feed

mediumCode4rena

Lines of code

https://github.com/code-423n4/2024-05-bakerfi/blob/main/contracts/oracles/EthOracle.sol#L31

Vulnerability details

Description

Chainlink aggregators have a built in circuit breaker if the price of an asset goes outside of a predetermined price band. The result is that if an asset experiences a huge drop in value (i.e. LUNA crash) the price of the oracle will continue to return the minPrice instead of the actual price of the asset. This would allow user to continue borrowing with the asset but at the wrong price. This is exactly what happened to Venus on BSC when LUNA imploded. However, the protocol misses to implement such a check.

Link to code:

js📋
    function getLatestPrice() public view override returns (IOracle.Price memory price) {
@-->    (, int256 answer, uint256 startedAt, uint256 updatedAt,) = _ethPriceFeed.latestRoundData();
        if ( answer<= 0 ) revert InvalidPriceFromOracle();        
        if ( startedAt ==0 || updatedAt == 0 ) revert InvalidPriceUpdatedAt();    

        price.price = uint256(answer);
        price.lastUpdate = updatedAt;
    }

Similar past issues

• https://github.com/sherlock-audit/2023-05-USSD-judging/issues/598
• https://github.com/sherlock-audit/2023-02-blueberry-judging/issues/18

Tools Used

Manual review

Recommended Mitigation Steps

Add logic along the lines of:

js📋
    require(answer >= minPrice && answer <= maxPrice, "invalid price");

min and max prices can be gathered using one of these ways.

Assessed type

Oracle