WASM Integration - UMEE

In the recent branch, SlashWindow query has been added. SlashWindow queries the current slash window progress of the oracle. However, the query is not added into the wasm handlers.

Code Location

Location

func (q querier) SlashWindow(
    goCtx context.Context,
    req *types.QuerySlashWindow,
) (*types.QuerySlashWindowResponse, error) {
    if req == nil {
        return nil, status.Error(codes.InvalidArgument, "empty request")
    }

    ctx := sdk.UnwrapSDKContext(goCtx)
    params := q.GetParams(ctx)

    slashWindow := params.SlashWindow
    votePeriod := params.VotePeriod
    currentBlock := uint64(ctx.BlockHeight())
    votePeriodsPerSlashWindow := slashWindow / votePeriod

    currentSlashWindow := currentBlock / votePeriodsPerSlashWindow
    blocksIntoSlashWindow := currentBlock - (currentSlashWindow * slashWindow)

    return &types.QuerySlashWindowResponse{
        WindowProgress: blocksIntoSlashWindow / votePeriod,
    }, nil
}

PENDING: The UMEE Team will fix this issue in a future release.

There are a few 3rd party packages that are being used that contain vulnerabilities.

\begin{center} \begin{tabular}{|l|p{3cm}|p{2cm}|l|} \hline \textbf{ID} & \textbf{Package} & \textbf{Rating} & \textbf{Description} \ \hline \href{https://ossindex.sonatype.org/vulnerability/sonatype-2021-0598}{sonatype-2021-0598} & tendermint & MEDIUM & Improper Input Validation \ \hline \href{https://ossindex.sonatype.org/vulnerability/sonatype-2022-3945}{sonatype-2022-3945} & go-buffer-poo & MEDIUM & Integer Overflow or Wraparound \ \hline \href{https://ossindex.sonatype.org/vulnerability/sonatype-2021-0456}{sonatype-2021-0456} & websocket & HIGH & Uncontrolled Resource Consumption \ \hline \href{https://ossindex.sonatype.org/vulnerability/sonatype-2021-0076}{sonatype-2021-0076} & go-ethereum & HIGH & Uncontrolled Resource Consumption \ \hline \href{https://ossindex.sonatype.org/vulnerability/CVE-2022-23328}{CVE-2022-23328} & go-ethereum & HIGH & Denial of Service attack \ \hline \end{tabular} \end{center}

PENDING: The UMEE Team will fix this issue in a future release.

There are a few instances where error handling has not been implemented for functions that might return an error.

Code Location

price-feeder/oracle/provider/huobi.go, Lines 384-387

func (p *HuobiProvider) reconnect() error {
    p.wsClient.Close()

    p.logger.Debug().Msg("reconnecting websocket")

price-feeder/oracle/provider/gate.go, Lines 548-551

func (p *GateProvider) reconnect() error {
    p.wsClient.Close()

    p.logger.Debug().Msg("reconnecting websocket")

price-feeder/oracle/provider/coinbase.go, Lines 482-485

func (p *CoinbaseProvider) reconnect() error {
    p.wsClient.Close()

    p.logger.Debug().Msg("reconnecting websocket")

price-feeder/oracle/provider/binance.go, Lines 362-366

func (p *BinanceProvider) reconnect() error {
    p.wsClient.Close()

    p.logger.Debug().Msg("reconnecting websocket")

SOLVED: The UMEE Team has implemented the correct error handling on Issue 1192.

There are two instances where an error check is not required, and the logic can be adjusted to only return the value.

Code Location

x/leverage/types/tx.go, Lines 115-121

func (msg *MsgDecollateralize) ValidateBasic() error {
    _, err := sdk.AccAddressFromBech32(msg.Borrower)
    if err != nil {
        return err
    }
    return nil
}

x/leverage/types/tx.go, Lines 86-92

func (msg *MsgCollateralize) ValidateBasic() error {
    _, err := sdk.AccAddressFromBech32(msg.Borrower)
    if err != nil {
        return err
    }
    return nil
}

SOLVED: The UMEE Team has implemented the correct error handling on Issue 1194.

It was found that Write is being used to generate HTTP responses, instead of using the html/template package that handles HTML and other encodings more safely.

Code Location

price-feeder/router/v1/router.go, Line 113

        _, _ = w.Write(gr.Metrics)

price-feeder/router/v1/response.go, Line 48

    _, _ = w.Write(bz)

SOLVED: The UMEE Team has implemented the correct error handling on Issue 1195.

Several instances of the panic function were identified in the codebase. They appear to be used to handle errors. This can cause potential issues, as invoking a panic can cause the program to halt execution and crash in some cases. This in turn can negatively impact the availability of the software for users.

Code Location

The following are just a few samples of the usage of panic.

x/leverage/abci.go, Lines 11-21

func EndBlocker(ctx sdk.Context, k keeper.Keeper) []abci.ValidatorUpdate {
    if err := k.SweepBadDebts(ctx); err != nil {
        panic(err)
    }

    if err := k.AccrueAllInterest(ctx); err != nil {
        panic(err)
    }

    return []abci.ValidatorUpdate{}
}

xx/leverage/keeper/keeper.go, Lines 64-66

    if k.hooks != nil {
        panic("leverage hooks already set")
    }

ACKNOWLEDGED: The UMEE Team acknowledged this finding.

Open To-dos can point to architecture or programming issues that still need to be resolved. Often these kinds of comments indicate areas of complexity or confusion for developers. This provides value and insight to an attacker who aims to cause damage to the protocol.

Code Location

Open Todos

./x/leverage/module.go:28:      // TODO: Ensure x/leverage implements simulator and then uncomment.
./x/leverage/keeper/interest.go:164:    // TODO: use typed events
./x/leverage/keeper/interest.go:76:             // @todo fix this when tendermint solves #8773

ACKNOWLEDGED: The UMEE Team acknowledged this finding.