Skip to content
This repository has been archived by the owner on Nov 26, 2023. It is now read-only.

shaka - Wrong address for DAIEthOracle in StableOracleDAI.sol:DAIEthOracle and StableOracleWBGL.sol:staticOracleUniV3 #65

Closed
sherlock-admin opened this issue May 23, 2023 · 0 comments
Closed

shaka - Wrong address for DAIEthOracle in StableOracleDAI.sol:DAIEthOracle and StableOracleWBGL.sol:staticOracleUniV3 #65

sherlock-admin opened this issue May 23, 2023 · 0 comments
Labels
Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label High A valid High severity issue Reward A payout will be made for this issue

Comments

@sherlock-admin
Copy link
Contributor

sherlock-admin commented May 23, 2023 •
edited by github-actions bot
Loading

shaka

high

Wrong address for DAIEthOracle in StableOracleDAI.sol:DAIEthOracle and StableOracleWBGL.sol:staticOracleUniV3

Summary

Wrong address for DAIEthOracle in StableOracleDAI.sol:DAIEthOracle and StableOracleWBGL.sol:staticOracleUniV3.

Vulnerability Detail

In the constructor of StableOracleDAI.sol and StableOracleWBGL.sol the value of the static oracles (DAIEthOracle and staticOracleUniV3) is initialized with the address 0x982152A6C7f732Ec7C9EA998dDD9Ebde00Dfa16e. This is the address of Uniswap WBGL/WETH pool, which does not implement the quoteSpecificPoolsWithTimePeriod function.

Impact

Calls to getPriceUSD() in StableOracleDAI and StableOracleWBGL will fail. This will make not possible minting or rebalancing USSD.

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleDAI.sol#L27-L29

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWBGL.sol#L18-L20

Tool used

Manual Review

Recommendation

Use the correct address for static oracle contracts.

Duplicate of #817
@github-actions github-actions bot closed this as completed Jun 5, 2023
@github-actions github-actions bot added High A valid High severity issue Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label labels Jun 5, 2023
@sherlock-admin sherlock-admin added the Reward A payout will be made for this issue label Jun 23, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label High A valid High severity issue Reward A payout will be made for this issue
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@sherlock-admin