SJIP 8: Missing Curcuit Breaker Checks

[WangSecurity]

Description

Make Chainlick's Curcuit Breaker Checks (checking if price if above/lower maxAnswer/minAnswer) low severity by default

Judging Guidelines PR

https://github.com/sherlock-protocol/sherlock-v2-docs/pull/32/files

Rationale

Firstly, on most of price feeds these checks are deprecated as can be seen in Chainlink's Docs

Secondly, while it's still used on some of them, these are basically sanity checks, e.g. minAnswer on ETH/USD Price Feed is $10.

Hence, to improve the judging efficiency and let Watsons spend more time on more complex issues, I believe missing checks for minAnswer and maxAnswer should be clarified as low severity so it doesn't cause unnecessary discussions.

Relevant Issue Discussions

sherlock-audit/2024-04-alchemix-judging#80

[IllIllI000]

Correct me if I'm wrong, but it looks like all of the other rules are exclusions of actual low severity, whereas this I believe is the first Med that's being excluded. Shouldn't it be a readme question rather than changing to low severity?

[WangSecurity]

Actually, the decision to make such proposal is because it's a low and not a med severity. As I've said above, most of the price feeds don't even have minAnswer and maxAnswer at all, but if they have, it's only a sanity check. Glad to discuss it with you, please share your thoughts!

[IllIllI000]

LUNA's minAnswer was $0.10 and caused a disaster. Until there are no legacy circuitbreakers anymore, I don't think you can say it is Low

[WangSecurity]

Then the question here boils down to which and how many tokens use minAnswer and maxAnswer. I'll try to find more specific information about it and get back here.

[WangSecurity]

After additional discussions, we agree that this should remain medium. But, since not all price feeds have circuit breakers, for the finding to be valid, the price feeds which still have these checks should be explicitly mentioned (updated the PR).

[WangSecurity]

Updated the language a bit. Since no other questions are raised, planning to move to the last call and add to batch 2