# AfEth deposits could use price data from an invalid Chainlink response

VotiumStrategy.price() calls ethPerCvx(false), skipping Chainlink validation, so stale or failed feed data skews AfEth price and mints wrong token amounts on deposit.

- Payout: Contest reward
- Severity: high
- Program: Asymmetry Finance
- Credited: adriro
- Disclosed: 2024-02-06
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-09-asymmetry-findings/issues/34
- Library page: https://bugbountylibrary.com/r/c4%3A2023-09-asymmetry%3AH-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** AfEth/VotiumStrategy price oracle (Chainlink CVX/ETH feed)
**Root cause:** ethPerCvx(false) bypasses all validation of the Chainlink latestRoundData response, so a stale, zero, or failed-call answer is returned and propagated into VotiumStrategy.price() and AfEth.price().
**Steps:**
1. Observe VotiumStrategy.price() calls `ethPerCvx(false)` (VotiumStrategy.sol L31-33).
2. Note ethPerCvx with `_validate=false` returns `uint256(cl.answer)` without checking success, roundId, updatedAt, or staleness (VotiumStrategyCore.sol L156-186).
3. Call `AfEth.deposit(_minout)` while the CVX/ETH feed is stale and real price has risen.
4. priceBeforeDeposit computed from stale lower price; amountToMint = totalValue / priceBeforeDeposit yields more tokens than deserved.
**How found:** Code reading of the price path: noticed the `_validate` flag passed as false in VotiumStrategy.price(), traced ethPerCvx to see the try/catch returns an uninitialized/zero answer on failure and skips all checks when validation is off.
**Exploitation:** Attacker waits for a stale Chainlink CVX/ETH round where real price exceeds feed price, then deposits into AfEth to receive excess shares minted at the undervalued price, diluting existing holders.
**Insight:** When a validation helper takes a boolean flag, grep every call site for `false` — a single unchecked caller in a price path silently disables all oracle sanity checks downstream.