Skip to content

Latest commit

 

History

History
53 lines (28 loc) · 2.23 KB

038.md

File metadata and controls

53 lines (28 loc) · 2.23 KB

Small Shamrock Rook

Medium

OracleUtils.ethLeftSide() is not correct for some tokens, leading to incorrect nuAsset pricing

Summary

OracleUtils::ethLeftSide() is used to check whether ETH is in the numerator or the denominator of the price feed, in order to correctly price the paired asset.

The check is implemented incorrectly, causing incorrect pricing of assets in some cases.

Root Cause

The function OracleUtils::ethLeftSide() checks the first 3 characters of the pricefeed’s description string, and checks if they are “ETH”. If so, it assumes that the numerator is ETH.

The issue is that there are assets which have “ETH” as the first 3 characters, but are not ETH. An example is the LST, Stader ETHx.

It has a price feed on Arbitrum Mainnet, denominated in ETH, with the description string “ETHx/ETH”.

Even though ETH is on the right side, the ethLeftSide() function will return true, which is incorrect.

This causes the asset to be priced incorrectly in the NumaPrinter, since it assumes that the asset is ETH.

Note: the protocol team has stated:

This should be able to theoretically mint any asset with a chainlink (18 decimals), including RWA assets.

This could be assets like currencies (nuUSD, nuEUR, etc), commodities (nuGOLD, nuOIL, etc), other cryptocurrencies (nuETH, nuBTC), and stocks (nuTSLA, nuNVDA, etc)

Internal pre-conditions

An asset like ETHx is used as a nuAsset

External pre-conditions

No response

Attack Path

No response

Impact

nuAssets can be priced incorrectly in some cases

PoC

No response

Mitigation

Check the first 4 bytes of the pricefeed's description string, and return true only if the first 4 bytes are the same as “ETH/” This ensures that the function is always correct