Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Takara Lend Contracts>Threat Model>Component: Oracle contracts
GeneralOverview
Findings
Critical (1)
High (2)
Medium (1)
Low (4)
Informational (3)
DiscussionMisleadingly named liquidatable global flagUnused added constants in TTokenStoragePotential revert griefing in the liquidation flow
Threat ModelComponent: ComptrollerComponent: ErrorReporterComponents: TErc20Delegator, TErc20, and TTokenComponent: JumpRateModelComponent: RateComponent: Oracle contractsComponent: Utility contracts
Audit ResultsAssessment Results

Component: Oracle contracts

Description

Four oracle-related contracts were added. They are the Api3Aggregator, Api3LinkedAggregator, LinkedAssetAggregator, and CompositeOracle. The aggregator contracts all implement the AggregatorV3Interface, which is an interface defined by Chainlink that contains the view function latestRoundData, which returns the current price and staleness from a particular data source. The CompositeOracle maintains a list of aggregators and queries fallback aggregators farther down the list if any are down or stale.

Invariants

  • The oracle contracts should always return a price that is within a reasonable range of the true price.

  • The oracle contracts should not return outdated prices.

  • The oracle contracts should not return until a grace period has passed since the sequencer came back online.

Test coverage

No tests.

Attack surface

  • The oracle contracts may be manipulated to return a price that is not within a reasonable range of the true price.

  • Incorrect freshness checks could lead to the use of outdated price data, potentially causing a loss of funds in the protocol.

Zellic © 2025Back to top ↑