SJIP: Remove the min/maxAnser guideline

[WangSecurity]

Description

Remove the guideline about min/maxAnswer checks being a valid issue and make it invalid

Judging Guidelines PR

https://github.com/sherlock-protocol/sherlock-v2-docs/pull/53/files

Rationale

The reason for removing is because the price below minAnswer or above maxAnswer cannot be reported. If the price falls out of the range, the oracle will return the last price inside the range.

For example, if the minAnswer is 100, the price at T20 is 107, but at T21 the price is 90, the oracle will return the price 107 and timestamp T20. Hence, even if the oracle returns price 107 and timestamp T20, the minAnswer check will not help here and the contract will use this price until T20 becomes stale. Hence, the checks about minAnswer and maxAnswer will not help.

Ultimately, we're making a guideline to make those issues invalid. If you need more technical details about the above, please ask it in the comments.

Relevant Issue Discussions

The specific discussion was on Private contest.

Update

Based on the discussion, it was decided to leave this type of issues valid, but rather change the wording of the guideline to make the reports about these issues better.

[IllIllI000]

The docs say, Configure your application to detect when the reported answer is close to reaching reasonable minimum and maximum limits so it can alert you to potential market events.. One way to prevent being rekt is to reject prices that are equal to those bounds. I don't see what the problem with the existing rule is. Checks would help.

[WangSecurity]

Sounds good, to explain the second point, I think we can add this stack overflow page since I'm always using it to explain why the checks are deprecated. So it looks like this:

Chainlink Price Checks: Issues related to minAnswer and maxAnswer checks on Chainlink's Price Feeds are considered medium only if the Watson explicitly mentions the price feeds (e.g. USDC/ETH) for the in-scope tokens on the in-scope chains that require this check. Additionally, a proper attack path and at least medium severity impact must be included in the report. See this to know if min/maxAnswer are deprecated on the price feed.

What do you think?

[WangSecurity]

Updated the guideline to the above and moved to last call.

[IllIllI000]

Perhaps it would be good to have a completely new section on how to judge submissions based on attack paths and impacts, with examples of invalid findings due to insufficient details in one or both of those sections. This would help to level-set a standard for new community judges.

What you currently have sounds fine for now.

[WangSecurity]

Yeah, that's a very good suggestion to add such a section, though in a different SJIP. Feel free to add any of reports you think would be good for such a section.

[IllIllI000]

sounds good. I don't have any at the moment, but will let you know privately as I come across them