Skip to content
Request an audit

‹ All findings

Attacker can trigger temporary shutdown due to RedStonePriceFeedBase missing gas check

MediumFelix Price Feeds·0xSimao · CDP stablecoin · 14th March 2025M-1

ReportSource

Description:

RedStonePriceFeedBase::_getCurrentRedStoneResponse() does not check gas left in the catch block, allowing attackers to forward just a bit of gas to make the call to chainlink revert and trigger a temporary shutdown.

Impact:

Protocol DoS.

Recommended Mitigation:

See the LiquityV2 check here.

0xSimao:

Fixed in #a0041e1.