Design/Logic Flaw

2020-06-0317:15:00

PRIOn knowledge base

www.prio-n.com

7.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.9%

JSON

The price oracle in PriceOracle.sol in Compound Finance Compound Price Oracle 1.0 through 2.0 allows a price poster to set an invalid asset price via the setPrice function, and consequently violate the intended limits on price swings.

CPENameOperatorVersion
price_oraclege1.0
price_oraclele2.0

CPE	Name	Operator	Version
	price_oracle	ge	1.0
	price_oracle	le	2.0

References

privacylog.blogspot.com/2019/10/compound-finance-zero-day-prices-can.html