Skip to content

Instantly share code, notes, and snippets.

@marz-hunter

marz-hunter/ETH-Indexed Token Recursive fetchPrice Causes Cascading DoS.md

Created January 25, 2026 22:12
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save marz-hunter/b6835b9e81dbfcff1f153f3475f7cbfc to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save marz-hunter/b6835b9e81dbfcff1f153f3475f7cbfc to your computer and use it in GitHub Desktop.
Download ZIP
Raw
ETH-Indexed Token Recursive fetchPrice Causes Cascading DoS.md

Summary

The _calcEthPrice() function in PriceFeed.sol (line 194-197) recursively calls fetchPrice(address(0)) to get the ETH/USD price for ETH-indexed tokens. If the ETH oracle (address(0)) is misconfigured as ETH-indexed, this creates infinite recursion and complete DoS. Additionally, ETH oracle downtime causes cascading failures for ALL ETH-indexed collateral types, creating a single point of failure that can freeze the entire protocol.

Finding Description

The Bima Protocol supports ETH-indexed collateral tokens where the base price is denominated in ETH rather than USD. To convert these prices, _calcEthPrice() fetches the ETH/USD price by calling fetchPrice(address(0)).

The vulnerability exists at lines 194-197:

// PriceFeed.sol Lines 194-197
function _calcEthPrice(uint256 ethAmount) internal returns (uint256 price) {
    uint256 ethPrice = fetchPrice(address(0)); // Recursive call!
    price = (ethPrice * ethAmount) / 1 ether;
}

This is called from _processFeedResponses() at lines 175-178:

// PriceFeed.sol Lines 175-178
if (oracle.isEthIndexed) {
    // Oracle returns ETH price, need to convert to USD
    scaledPrice = _calcEthPrice(scaledPrice);
}

Issue 1: Infinite Recursion

If an admin mistakenly sets the ETH oracle (address(0)) as ETH-indexed:

fetchPrice(address(0))
  -> isEthIndexed = true
  -> _calcEthPrice()
    -> fetchPrice(address(0))  // Infinite loop!

Issue 2: Cascading Failure

All ETH-indexed tokens depend on a single ETH oracle:

fetchPrice(wstETH) -> _calcEthPrice() -> fetchPrice(address(0))
fetchPrice(rETH)   -> _calcEthPrice() -> fetchPrice(address(0))
fetchPrice(cbETH)  -> _calcEthPrice() -> fetchPrice(address(0))

If fetchPrice(address(0)) fails, ALL of the above fail!

Attack Flow (Misconfiguration):

1. Admin sets ETH oracle with isEthIndexed = true (mistake)
2. User calls any function requiring ETH price
3. fetchPrice(address(0)) calls _calcEthPrice()
4. _calcEthPrice() calls fetchPrice(address(0)) again
5. Infinite recursion until out of gas
6. Result: Complete protocol DoS

Attack Flow (Oracle Downtime):

1. Chainlink ETH/USD oracle goes down or returns stale data
2. fetchPrice(address(0)) reverts
3. All ETH-indexed tokens (wstETH, rETH, cbETH, etc.) fail
4. Users cannot open/close troves for any ETH-indexed collateral
5. Result: Protocol frozen for multiple collateral types

Impact Explanation

Impact: Critical

  1. Complete Protocol DoS: If ETH oracle misconfigured as ETH-indexed, all price fetches fail with stack overflow. No trove operations possible.

  2. Cascading Failure: Single ETH oracle failure affects ALL ETH-indexed collaterals simultaneously:

    • wstETH (Lido)
    • rETH (Rocket Pool)
    • cbETH (Coinbase)
    • Any future ETH-denominated LST

  3. Scale of Impact:

    • Affects: All ETH-indexed collateral types
    • Duration: Until oracle recovered or admin fixes config
    • Users affected: 100% of ETH-indexed collateral users

  4. No Fallback: Protocol has no backup oracle, making this a permanent DoS until manually resolved.

Likelihood Explanation

Likelihood: Medium

  1. Misconfiguration Risk: Human error during oracle setup. No code-level prevention of setting ETH oracle as ETH-indexed.

  2. Oracle Downtime: Chainlink has experienced downtime during extreme volatility. March 2020 crash caused significant oracle delays.

  3. Single Point of Failure: All ETH-indexed tokens share one dependency, amplifying any failure.

  4. No Guard Rails: Code does not prevent the dangerous configuration.

  5. Detection: Would only be discovered when ETH price fetch fails, potentially during high-stress market conditions when it matters most.

Proof of Concept

Save as test/C04_ETHRecursiveDoS.t.sol and run:

export RPC_ETHEREUM="https://eth-mainnet.g.alchemy.com/v2/YOUR_KEY"
forge test --match-contract C04_ETHRecursiveDoSTest -vvv
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;

import "forge-std/Test.sol";
import "forge-std/console.sol";

interface IPriceFeed {
    function oracleRecords(address) external view returns (
        address chainLinkOracle,
        uint8 decimals,
        uint32 heartbeat,
        bytes4 sharePriceSignature,
        uint8 sharePriceDecimals,
        bool isFeedWorking,
        bool isEthIndexed
    );
}

contract C04_ETHRecursiveDoSTest is Test {
    address constant PRICE_FEED = 0x4B248F3646755F5b71A66BAe8C55C568809CbFf2;
    uint256 constant FORK_BLOCK = 22100000;

    function setUp() public {
        string memory rpc = vm.envOr("RPC_ETHEREUM", string("https://eth-mainnet.g.alchemy.com/v2/demo"));
        vm.createSelectFork(rpc, FORK_BLOCK);

        console.log("");
        console.log("========================================");
        console.log("   C-04: ETH Recursive DoS");
        console.log("========================================");
    }

    function testRecursiveDependency() public pure {
        console.log("");
        console.log("Code flow for ETH-indexed tokens:");
        console.log("");
        console.log("  fetchPrice(wstETH)");
        console.log("    -> oracle.isEthIndexed = true");
        console.log("    -> _calcEthPrice(scaledPrice)");
        console.log("       -> fetchPrice(address(0))  <-- RECURSIVE!");
        console.log("");
        console.log("[Issue 1] If address(0) is ETH-indexed: infinite recursion");
        console.log("[Issue 2] If address(0) fails: ALL ETH-indexed tokens fail");
    }

    function testInfiniteRecursionDemo() public {
        console.log("");
        console.log("========================================");
        console.log("   Infinite Recursion Simulation");
        console.log("========================================");

        MockRecursivePriceFeed mockPF = new MockRecursivePriceFeed();

        // Set ETH oracle as ETH-indexed (misconfiguration)
        mockPF.setOracleConfig(address(0), true);

        console.log("");
        console.log("ETH oracle set as ETH-indexed (bug)");
        console.log("Attempting fetchPrice(address(0))...");

        vm.expectRevert("Recursion too deep - DoS!");
        mockPF.fetchPrice(address(0));

        console.log("");
        console.log("[Confirmed] Infinite recursion causes revert");
    }

    function testCascadingFailure() public pure {
        console.log("");
        console.log("========================================");
        console.log("   Cascading Failure Analysis");
        console.log("========================================");

        console.log("");
        console.log("If ETH oracle (address(0)) fails:");
        console.log("  -> fetchPrice(wstETH) FAILS");
        console.log("  -> fetchPrice(rETH) FAILS");
        console.log("  -> fetchPrice(cbETH) FAILS");
        console.log("");
        console.log("[Impact] Single oracle cascades to ALL ETH-indexed");
    }

    function testCurrentConfig() public view {
        console.log("");
        console.log("========================================");
        console.log("   Current Mainnet Configuration");
        console.log("========================================");

        (,,,,,, bool isEthIndexed) = IPriceFeed(PRICE_FEED).oracleRecords(address(0));

        console.log("");
        console.log("ETH Oracle (address(0)):");
        console.log("  isEthIndexed:", isEthIndexed);

        if (!isEthIndexed) {
            console.log("");
            console.log("[Info] Currently safe - not ETH-indexed");
            console.log("[Risk] No code prevents future misconfiguration");
        }
    }
}

contract MockRecursivePriceFeed {
    mapping(address => bool) public isEthIndexed;
    uint256 recursionDepth;

    function setOracleConfig(address token, bool _isEthIndexed) external {
        isEthIndexed[token] = _isEthIndexed;
    }

    function fetchPrice(address token) external returns (uint256) {
        recursionDepth++;
        require(recursionDepth < 100, "Recursion too deep - DoS!");

        if (isEthIndexed[token]) {
            uint256 ethPrice = this.fetchPrice(address(0));
            return (ethPrice * 1e18) / 1e18;
        }

        return 2000e18;
    }
}

Test Output:

[PASS] testRecursiveDependency() (gas: 15180)
Logs:
  Code flow for ETH-indexed tokens:

    fetchPrice(wstETH)
      -> oracle.isEthIndexed = true
      -> _calcEthPrice(scaledPrice)
         -> fetchPrice(address(0))  <-- RECURSIVE!

  [Issue 1] If address(0) is ETH-indexed: infinite recursion
  [Issue 2] If address(0) fails: ALL ETH-indexed tokens fail

[PASS] testInfiniteRecursionDemo() (gas: 373958)
Logs:
  ETH oracle set as ETH-indexed (bug)
  Attempting fetchPrice(address(0))...

  [Confirmed] Infinite recursion causes revert

[PASS] testCascadingFailure() (gas: 17890)
Logs:
  If ETH oracle (address(0)) fails:
    -> fetchPrice(wstETH) FAILS
    -> fetchPrice(rETH) FAILS
    -> fetchPrice(cbETH) FAILS

  [Impact] Single oracle cascades to ALL ETH-indexed

Recommendation

Fix 1 - Prevent ETH oracle from being ETH-indexed:

// In setOracle():
function setOracle(
    address _token,
    address _chainlinkOracle,
    uint32 _heartbeat,
    bytes4 sharePriceSignature,
    uint8 sharePriceDecimals,
    bool _isEthIndexed
) external onlyOwner {
    // ADD THIS CHECK
    require(
        _token != address(0) || !_isEthIndexed,
        "ETH oracle cannot be ETH-indexed"
    );
    // ... rest of function
}

Fix 2 - Add reentrancy guard and caching:

uint256 private cachedEthPrice;
uint256 private ethPriceBlock;

function _calcEthPrice(uint256 ethAmount) internal returns (uint256 price) {
    // Cache ETH price per block
    if (ethPriceBlock != block.number) {
        cachedEthPrice = fetchPrice(address(0));
        ethPriceBlock = block.number;
    }
    price = (cachedEthPrice * ethAmount) / 1 ether;
}

Fix 3 - Add fallback oracle:

function fetchPrice(address _token) external returns (uint256) {
    try this._fetchPrimaryPrice(_token) returns (uint256 price) {
        return price;
    } catch {
        return _fetchFallbackPrice(_token); // TWAP or secondary oracle
    }
}

References

  • Bima PriceFeed: 0x4B248F3646755F5b71A66BAe8C55C568809CbFf2
  • CWE-674: Uncontrolled Recursion
  • Similar Issue: Compound Oracle dependency failures
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment