_validateOrder Does Not Allow Anyone To Be A Taker Of An Off-Chain Order

Handle leastwood Vulnerability details Impact The EIP1271Wallet contract intends to allow the treasury manager account to sign off-chain orders in 0x on behalf of the TreasuryManager contract, which holds harvested assets/COMP from Notional. While the EIP1271Wallet.validateOrder function mostly...

Use of deprecated Chainlink function latestAnswer

Handle WatchPug Vulnerability details According to Chainlink's documentation, the latestAnswer function is deprecated. This function does not revert if no answer has been reached but returns 0, causing an incorrect price fed to the EIP1271Wallet. See: code-423n4/2021-07-wildcredit-findings75 ---...

Usage of deprecated ChainLink API in EIP1271Wallet

Handle cmichel Vulnerability details The Chainlink API latestAnswer used in the EIP1271Wallet contract is deprecated: This API is deprecated. Please see API Reference for the latest Price Feed API. Chainlink Docs This function does not error if no answer has been reached but returns 0. Besides, t...

Use of deprecated Chainlink's latestAnswer API

Handle UncleGrandpa925 Vulnerability details Issue In EIP1271Wallet.sol, the function validateOrder uses the deprecated latestAnswer of Chainlink. This function might suddenly stop working if Chainlink stopped supporting it, and also will not error if no answer has been reached but returns 0...

latestAnswer doesn't check if the value is up to date

Handle pauliax Vulnerability details Impact EIP1271Wallet.sol is calling latestAnswer to get the last price: uint256 oraclePrice = toUint AggregatorV2V3InterfacepriceOracle.latestAnswer ; This method will return the last value, but you won’t be able to check if the data is fresh. On the other han...

Improper Validation Of Chainlink's latestAnswer Function

Handle leastwood Vulnerability details Impact The latestAnswer function does not allow EIP1271Wallet.validateOrder to validate the output of the Chainlink oracle query. As a result, it is possible for off-chain orders to use stale results, potentially allowing the taker of the order to extract mo...

Chainlink oracle query in _validateOrder does not check that response is fresh

Handle TomFrenchBlockchain Vulnerability details Impact Potential for TreasuryManager to use a stale price to calculate the slippage limit, allowing unacceptable slippage relative to if the price feed was current. Proof of Concept EIP1271Wallet queries Chainlink for the most recent price for...