EUSDMiningIncentives.purchaseOtherEarnings() call latestRoundData() but does not check if lbrPrice > 0

[code423n4]

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/miner/EUSDMiningIncentives.sol#L212

Vulnerability details

Impact

EUSDMiningIncentives.purchaseOtherEarnings() call latestRoundData() but does not check if lbrPrice > 0
If lbrPrice < 0, and the uint256(lbrPrice) will be so large, and cause the result of biddingFee is wrong.

Proof of Concept

As we can see, the EUSDMiningIncentives.purchaseOtherEarnings() call latestRoundData() but does not check if lbrPrice > 0

function purchaseOtherEarnings(address user, bool useEUSD) external updateReward(user) {
        require(isOtherEarningsClaimable(user), "The rewards of the user cannot be bought out");
        if(useEUSD) {
            require(isEUSDBuyoutAllowed, "The purchase using EUSD is not permitted.");
        }
        uint256 reward = rewards[user];
        if (reward > 0) {
            rewards[user] = 0;
            uint256 biddingFee = (reward * biddingFeeRatio) / 10000;
            if(useEUSD) {
                (, int lbrPrice, , , ) = lbrPriceFeed.latestRoundData();//@audit latestRoundData problem
                biddingFee = biddingFee * uint256(lbrPrice) / 1e8;
                bool success = EUSD.transferFrom(msg.sender, address(configurator), biddingFee);
                require(success, "TF");
                try configurator.distributeRewards() {} catch {}
            } else {
                IesLBR(LBR).burn(msg.sender, biddingFee);
            }
            IesLBR(esLBR).mint(msg.sender, reward);

            emit ClaimedOtherEarnings(msg.sender, user, reward, biddingFee, useEUSD, block.timestamp);
        }
    }

Tools Used

vs code

Recommended Mitigation Steps

Check the return value of latestRoundData() such as :
sherlock-audit/2023-02-blueberry-judging#94

Assessed type

Math

[c4-pre-sort]

JeffCX marked the issue as duplicate of #490

[c4-judge]

0xean marked the issue as unsatisfactory:
Out of scope

[c4-judge]

0xean changed the severity to QA (Quality Assurance)

[c4-judge]

0xean marked the issue as grade-c