CVE-2019-20809 : Exploit Details and Defense Strategies

Compound Finance's Compound Price Oracle 1.0 through 2.0 is vulnerable to a flaw in the setPrice function, allowing a price poster to input incorrect asset prices, breaching predefined price boundaries.

Understanding CVE-2019-20809

This CVE involves a vulnerability in the Compound Price Oracle versions 1.0 through 2.0 that enables manipulation of asset prices.

What is CVE-2019-20809?

The setPrice function in PriceOracle.sol allows a price poster to input inaccurate asset prices, violating price fluctuation limits.

The Impact of CVE-2019-20809

This vulnerability could lead to incorrect asset pricing, potentially affecting financial transactions and market stability.

Technical Details of CVE-2019-20809

The technical aspects of this CVE are as follows:

Vulnerability Description

The vulnerability in the Compound Price Oracle allows for the setting of invalid asset prices, bypassing intended limits on price swings.

Affected Systems and Versions

Product: Compound Finance's Compound Price Oracle
Versions: 1.0 through 2.0

Exploitation Mechanism

The flaw lies in the setPrice function, which permits the input of incorrect asset prices, compromising the integrity of price data.

Mitigation and Prevention

To address CVE-2019-20809, consider the following steps:

Immediate Steps to Take

Monitor asset prices for unusual fluctuations
Implement additional validation checks for price inputs
Restrict access to the setPrice function

Long-Term Security Practices

Regularly audit and update the price oracle system
Train personnel on secure coding practices
Stay informed about potential vulnerabilities in financial systems

Patching and Updates

Apply patches or updates provided by Compound Finance to fix the vulnerability