Skip to content

Update 0x303-I3-Oracle.md #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
CDSecurity wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Update 0x303-I3-Oracle.md #11

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7e9cb58
Update 0x303-I3-Oracle.md
CDSecurity Sep 7, 2023
4ebcdf5
Update 2.0/0x300-Integrations/0x303-I3-Oracle.md
CDSecurity Sep 8, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions 2.0/0x300-Integrations/0x303-I3-Oracle.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,13 @@ Category “I3” lists requirements related to the Oracle smart contract as one
| **I3.4** | Verify that, when using Uniswap V3 TWAP as price oracle, liquidity is high enough and is distributed widely across most of the price range. |
| **I3.5** | Verify that, the use a decentralized off-chain oracles unsusceptible to on-chain price manipulation attacks (e.g. Chainlink) is considered for low liquidity asset, ideally combining it with on-chain oracles to detect malicious values. |
| **I3.6** | Verify that the value you are using has had enough time to be reported as invalid and has not been. |
| **I3.7** | Verify that there is a check for stale prices when using Chainlink Oracle |
| **I3.8** | Verify that there is a check for down L2 sequencer when using Chainlink Oracle. |
| **I3.9** | Verify that NOT the same heartbeat is used for multiple price feeds when using Chainlink Oracle |
| **I3.10** | Verify that the code deals with different price feeds having different decimal precision when using Chainlink Oracle |
| **I3.11** | Verify that the price feed address wherever it is located(hardcoded, deployment script) is pointing to the correct oracle price feed |
| **I3.12** | Verify that the code handles calls to the oracle if they potentially revert when using Chainlink Oracle |
Copy link
Contributor

@damianrusinek damianrusinek Sep 12, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you mean a situation when call to price feed reverts? If so, what is the risk? The whole tx would revert right?

Copy link
Contributor

@damianrusinek damianrusinek Sep 28, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @CDSecurity, just a quick reminder. Can you elaborate on that?

| **I3.13** | Verify that the code handles the situation when oracle returns incorrect price during flash crashes when using Chainlink Oracle |

## References

Expand All @@ -32,3 +39,4 @@ For more information, see also:
* [So you want to use a price oracle](https://samczsun.com/so-you-want-to-use-a-price-oracle/)
* [Pricing LP tokens | Warp Finance hack](https://cmichel.io/pricing-lp-tokens/)
* [Uniswap V3 tick price manipulation](https://medium.com/@hacxyk/we-rescued-4m-from-rari-capital-but-was-it-worth-it-39366d4d1812)
* [Chainlink Oracle Considerations](https://medium.com/cyfrin/chainlink-oracle-defi-attacks-93b6cb6541bf)