Fast Khaki Raccoon
Medium
Incorrect min/maxPrice checks
ChainlinkSinglePriceOracle::_isValidAnswer() implements the following check:
if (_answer > _max || _answer < _min) {
_isValid = false;
}The issue is that the check is incorrect as it does not include the = sign. Also note that the min and max prices are deprecated but still available on some feeds such as DAI/USD on Arbitrum (DAI is supposed to be used as PAIRED_LP_TOKEN): https://arbiscan.io/address/0xFc06bB03a9e1D8033f87eA6A682cbd65477A43b9#readContract.
No response
No response
No attack path needed, min and max price checks don't work
Min and max price checks don't work properly, this can cause usage of incorrect prices
No response
Include the = sign, also consider reading https://rekt.news/venus-blizz-rekt/ to learn more about what could go wrong with that approach