Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

staleCheckLatestRoundData() uses TIMEOUT which is hard coded

ss3434

Summary

An immutable TIMEOUT might cause an incorrect staleness check leading to revert.

Vulnerability Details

19. uint256 private constant TIMEOUT = 3 hours; // 3 * 60 * 60 = 10800 seconds//@audit TIMEOUT is hardcoded
20.
21. function staleCheckLatestRoundData(AggregatorV3Interface priceFeed)
22. public
23. view
24. returns (uint80, int256, uint256, uint256, uint80)
25. {
26. (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
27. priceFeed.latestRoundData();
28.
29. uint256 secondsSince = block.timestamp - updatedAt;
30 if (secondsSince > TIMEOUT) revert OracleLib__StalePrice();//@audit check TIMEOUT
31.
32. return (roundId, answer, startedAt, updatedAt, answeredInRound);
33. }

Line 30 in the above code checks if the value of answer returned from the Chainlink feed is stale. If the time last update(secondsSince ) is larger than TIMEOUT (10800seconds/ 3 hours), then the value is considered stale,
However, the TIMEOUT is hardcoded and immutable. This might be an issue because Chainlink's heartbeat value might be changed in the future. For instance, it might reduce the heartbeat to 3600 seconds (1 hour). If this happen, the existing code will fail to detect the stale value returned from the price feed.
As mentioned by [Chainlink documentation](https://docs.chain.link/data-feeds):

Heartbeat and deviation thresholds can also differ for the same asset across different blockchains.

and existing observation that the heartbeat of price feed across different blockchains are often different (e.g. AAVE/USD on Ethereum - 1 hour heartbeat, AAVE/USD on Arbitrum - 24 hours heartbeat).

Impact

Risk of incorrect staleness check leading to the wrong price being computed.

Tools Used

Manual Review

Recommendations

Consider allowing the owner to update the heartbeat variable in the contract.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.