Skip to content

Latest commit

 

History

History
39 lines (23 loc) · 1.05 KB

028.md

File metadata and controls

39 lines (23 loc) · 1.05 KB

saidam017

high

StableOracleWBTC use wrong chainlink price feed contract address

Summary

StableOracleWBTC use wrong chainlink price feed address. functions rely on this data will not work properly.

Vulnerability Detail

StableOracleWBTC is used to get price of WBTC using Chainlink price feed, but priceFeed is defined using ETH/USD address (0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419) instead of WBTC/USD (0xF4030086522a5bEEa4988F8cA5B36dbC97BeE88c).

reference : https://docs.chain.link/data-feeds/price-feeds/addresses/?network=ethereum

Impact

Wrong price will returned and functions rely on this data will not work properly.

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWBTC.sol#L16-L18

Tool used

Manual Review

Recommendation

Use the correct price feed contract address :

    constructor() {
        priceFeed = AggregatorV3Interface(
            0xF4030086522a5bEEa4988F8cA5B36dbC97BeE88c // correct WBTC/USD price feed
        );
    }