Update 0x303-I3-Oracle.md #11
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Added 7 security considerations related to Chainlink Oracle as well as a link to the article which explains these problems more in depth.
damianrusinek
requested changes
Sep 7, 2023
damianrusinek
added a commit
to damianrusinek/SCSVS
that referenced
this pull request
Sep 8, 2023
…gory/nft Category/nft
Co-authored-by: Damian Rusinek <damian.rusinek@gmail.com>
| | **I3.9** | Verify that NOT the same heartbeat is used for multiple price feeds when using Chainlink Oracle | | ||
| | **I3.10** | Verify that the code deals with different price feeds having different decimal precision when using Chainlink Oracle | | ||
| | **I3.11** | Verify that the price feed address wherever it is located(hardcoded, deployment script) is pointing to the correct oracle price feed | | ||
| | **I3.12** | Verify that the code handles calls to the oracle if they potentially revert when using Chainlink Oracle | |
Contributor
There was a problem hiding this comment.
Do you mean a situation when call to price feed reverts? If so, what is the risk? The whole tx would revert right?
Contributor
There was a problem hiding this comment.
Hey @CDSecurity, just a quick reminder. Can you elaborate on that?
Contributor
|
Thanks @CDSecurity for update. I have addressed your comments. We are also thinking about how to present the checks for specific protocols (like Chainlink). One option is to separate them as I proposed here: https://github.com/ComposableSecurity/SCSVS/pull/12/files, but that is not yet decided. I am mentioning that because if we decide to separate them, these check will also have to be re-organized. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Added 7 security considerations related to Chainlink Oracle as well as a link to the article which explains these problems more in depth.