Skip to content

Latest commit

 

History

History
28 lines (17 loc) · 1.94 KB

057.md

File metadata and controls

28 lines (17 loc) · 1.94 KB

0xlmanini

high

StableOracleWBTC.sol uses incorrect price feed

Summary

The oracle uses priceFeed = AggregatorV3Interface(0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419) as the source for WBTC's price in USD, although such address corresponds to the ETH/USD feed, as can be seen in the price feed's etherscan page and on Chainlink's feed page.

Vulnerability Detail

See above.

Impact

The feed for WBTC/USD is set to the ETH/USD feed. Thus, all WBTC collateral in the system is priced as ETH. This affects both the user-facing function USSD.sol#calculateMint() which will return a much smaller amount of USSD to be minted in exchange for WBTC, and it also affects internal accounting functions like USSDRebalancer.sol#BuyUSSDSellCollateral() or USSDRebalancer.sol#SellUSSDBuyCollateral() in which the system must evaluate the value of its collateral.

Code Snippet

StableOracleWBTC.sol Notice the addess used is the same as the one used in StableOracleWETH.sol

Tool used

Manual Review

Recommendation

Given that no WBTC/USD feed is provided on Ethereum, use the combination of Chainlink BTC/USD feed and WBTC/BTC feed