0x52 - BlueBerryBank#getPositionValue causes DOS if reward token is added that doens't have an oracle
Opened this issue · 2 comments
0x52
high
BlueBerryBank#getPositionValue causes DOS if reward token is added that doens't have an oracle
Summary
collToken.pendingRewards pulls the most recent reward list from Aura/Convex. In the event that reward tokens are added to pools that don't currently have an oracle then it will DOS every action (repaying, liquidating, etc.). While this is only temporary it prevents liquidation which is a key process that should have 100% uptime otherwise the protocol could easily be left with bad debt.
Vulnerability Detail
(address[] memory tokens, uint256[] memory rewards) = IERC20Wrapper(
pos.collToken
).pendingRewards(pos.collId, pos.collateralSize);
for (uint256 i; i < tokens.length; i++) {
rewardsValue += oracle.getTokenValue(tokens[i], rewards[i]);
}
Using the pendingRewards method pulls a fresh list of all tokens. When a token is added as a reward but can't be priced then the call to getTokenValue will revert. Since getPostionValue is used in liquidations, it temporarily breaks liquidations which in a volatile market can cause bad debt to accumulate.
Impact
Temporary DOS to liquidations which can result in bad debt
Code Snippet
Tool used
Manual Review
Recommendation
Return zero valuation if extra reward token can't be priced.
Fix looks good. Reward token is only priced if currently supported by the oracle.