Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Sensitivity to rapid price change #287

Open
code423n4 opened this issue Sep 19, 2022 · 3 comments
Open

Sensitivity to rapid price change #287

code423n4 opened this issue Sep 19, 2022 · 3 comments
Labels
old-submission-method QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax sponsor disputed Sponsor cannot duplicate the issue, or otherwise disagrees this is an issue

Comments

@code423n4
Copy link
Contributor

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/Controller.sol#L96-L99

Vulnerability details

Impact

Sensitivity to rapid price change

Proof of Concept

It is actually not rare for some stablecoins like DAI, MIM, FEI, or even USDT to flash-depeg for a very short amount of time. Currently, the protocol doesn't protect RISK users from such brief events.

It would be better if depeg event could be triggered only if the depeg happened for real. This would require either some form of TWAPing.

Tools Used

Manual review

Recommended Mitigation Steps

We recommend protecting RISK users from flash-depegs by utilizing TWAPing or an oracle that supports TWAP price feeds.
@code423n4 code423n4 added 3 (High Risk) Assets can be stolen/lost/compromised directly bug Something isn't working old-submission-method labels Sep 19, 2022
code423n4 added a commit that referenced this issue Sep 19, 2022
@code423n4
PwnPatrol issue #287
650c14b
@MiguelBits MiguelBits added sponsor disputed Sponsor cannot duplicate the issue, or otherwise disagrees this is an issue and removed bug Something isn't working labels Sep 20, 2022
@3xHarry
Copy link
Collaborator

3xHarry commented Sep 22, 2022

Not relevant, as pricefeeds are exclusive chainlink oracles

@3xHarry 3xHarry added the invalid This doesn't seem right label Sep 22, 2022
@liveactionllama liveactionllama removed the invalid This doesn't seem right label Oct 3, 2022
@HickupHH3
Copy link
Collaborator

Similar to #283 where the issue relates to the choice of oracle.

@HickupHH3
Copy link
Collaborator

README mentions that Chainlink oracles are used. Downgrading to NC.

Warden's primary QA.

@HickupHH3 HickupHH3 added QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax and removed 3 (High Risk) Assets can be stolen/lost/compromised directly labels Oct 18, 2022
@HickupHH3 HickupHH3 mentioned this issue Nov 1, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
old-submission-method QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax sponsor disputed Sponsor cannot duplicate the issue, or otherwise disagrees this is an issue
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@MiguelBits @code423n4 @HickupHH3 @liveactionllama @3xHarry