# Funding settlement will be DOS'd for a time after the phaseID change of an underlying chainlink aggregator

Hubble's funding settlement assumes Chainlink roundID increments by one, so a phaseID change skips 2^64 rounds and reverts settleFunding, DOSing all markets' funding for up to 24h.

- Payout: Contest reward
- Severity: medium
- Program: Hubble Exchange
- Credited: 0x52
- Disclosed: 2023-04-16
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-04-hubble-exchange-judging/issues/177
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-04-hubble-exchange%3AM-10
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm technique:source-review vuln:dos vuln:oracle-manipulation

**Target:** Chainlink aggregator roundID handling in funding settlement
**Root cause:** Oracle code assumes roundID increments by one, but Chainlink packs phaseId and aggregatorRoundId into roundID; a phaseID increment jumps roundID by 2^64, so querying currentRound-1 reverts.
**Steps:**
1. Observe Chainlink aggregator getAnswer parses roundID into (uint16 phaseId, uint64 aggregatorRoundId) via parseIds
2. Note phaseID increment makes roundID jump by 2**64
3. Call settleFunding after a phaseID change: query of `currentRound - 1` reverts because that round does not exist
4. All markets settle simultaneously, so one oracle's phase shift DOSes funding across every market until a full funding interval elapses
**How found:** Read the ETH/USD AVAX aggregator source, noticed roundID is two packed values (phaseId + aggregatorRoundId), and reasoned that a phaseID increment skips 2**64 rounds, breaking the currentRound-1 assumption.
**Escalation:** Single oracle phaseID shift cascades to all markets since funding settles simultaneously; after DOS ends, catch-up uses different TWAP values, mispaying users.
**Insight:** When integrating Chainlink, never treat roundID as a monotonic counter; decode phaseId/aggregatorRoundId and handle phase transitions (try/catch, fall back to lower phaseId) since phaseID bumps jump roundID by 2^64.