PT-2018-3542 · Compound Finance · Compound Price Oracle

Publicado 2018-11-11 · Atualizado 2021-07-21 · CVE-2019-20809

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Compound Price Oracle versions 1.0 through 2.0

Description: The issue concerns the price oracle in Compound Finance's Compound Price Oracle, where the setPrice function in PriceOracle.sol lacks sufficient input validation. This allows a price poster to set an invalid asset price, potentially violating the intended limits on price swings. The vulnerability can be exploited by a remote attacker to elevate their privileges.

Recommendations: For Compound Price Oracle versions 1.0 through 2.0, consider restricting access to the setPrice function in PriceOracle.sol to minimize the risk of exploitation. As a temporary workaround, avoid using the setPrice function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2020-03431

CVE-2019-20809

Produtos afetados

Compound Price Oracle

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-20809 · Nota de Segurança
• https://bdu.fstec.ru/vul/2020-03431 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-20809 · Aviso do Fabricante
• https://privacylog.blogspot.com/2019/10/compound-finance-zero-day-prices-can.html · Nota