PT-2018-3542 · Compound Finance · Compound Price Oracle

Published 2018-11-11 · Updated 2021-07-21 · CVE-2019-20809

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Compound Price Oracle versions 1.0 through 2.0

Description: The issue concerns the price oracle in Compound Finance's Compound Price Oracle, where the setPrice function in PriceOracle.sol lacks sufficient input validation. This allows a price poster to set an invalid asset price, potentially violating the intended limits on price swings. The vulnerability can be exploited by a remote attacker to elevate their privileges.

Recommendations: For Compound Price Oracle versions 1.0 through 2.0, consider restricting access to the setPrice function in PriceOracle.sol to minimize the risk of exploitation. As a temporary workaround, avoid using the setPrice function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-03431

CVE-2019-20809

Affected Products

Compound Price Oracle

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-20809 · Security Note
• https://bdu.fstec.ru/vul/2020-03431 · Security Note
• https://osv.dev/vulnerability/CVE-2019-20809 · Vendor Advisory
• https://privacylog.blogspot.com/2019/10/compound-finance-zero-day-prices-can.html · Note