Skip to content

Negative Oracle Answer (int256) Not Handled

SAFE-0205 Oracle / Price Checked automatically by the scanner
1

What goes wrong

Chainlink returns an int256; a negative value cast straight to uint256 becomes an astronomically large number. Without a require(answer > 0), a negative or zero answer is turned into a near-infinite price.

2

The vulnerable pattern

proof of concept — how it is exploited
// answer = -1 (feed glitch)
// uint256(-1) = 2**256 - 1 -> collateral value = ~infinity
// attacker borrows everything against 1 wei.
3

How to fix it

the pattern that is safe
(, int256 answer,,,) = feed.latestRoundData();
require(answer > 0, "bad price");
uint256 price = uint256(answer);
Reject non-positive int256 answers before casting.
4

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0205 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs