048.md

Furry Rusty Monkey

Medium

ChainlinkOracle doesn't validate for minAnswer/maxAnswer

Summary

The protocol uses Chainlink AggregatorV3Interface for mainnet interactions. Chainlink Oracle doesn't validate for minAnswer/maxAnswer

Vulnerability Details

Current implementation of Chainlink Oracle _price doesn't validate for the minAnswer/maxAnswer values

(, int256 price_, , , ) = oracle.latestRoundData();

Chainlink still has feeds that uses the min/maxAnswer to limit the range of values and hence in case of a price crash, incorrect price will be used to value the assets allowing user's to exploit this incorrectness by depositing the overvalued asset and borrowing against it.

Impact

In the event of a flash crash, user's lenders will loose their assets

Code Snippet

https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/oracles/MasterPriceOracle.sol#L83

Tool Used

Manual review

Recommendation

Consider checking if the price returned is not outside the aggregator’s minAnswer/maxAnswer bounds and revert if it is.