In case of price is not updated for a long time, the protocol may deny service to the user as the price is considered stale when not updated for 3 hours.
OracleLib
expects that the value of updatedAt
returned by latestRoundData
should be in the range of the block.timestamp
and block.timestamp - 3 hours
. The issue here is that if the price was not updated in the last 3 hours, the protocol would mark the price as stale and therefore revert the execution, even though the price may still be valid.
There are two parameters that must trigger price updates:
deviation threshold - the percentage change in an asset price
heartbeat period - the time period after which the price must be updated
These two triggers are the ones that should be considered as the ones that must update the price. In case there is no big change in the price, for example, when the market is calm, there is no guarantee the price will be updated. Also, the hardcoded value of 3 hours may be enough for most of the tokens which have a heartbeat of 1 hour, but there are some that have a heartbeat period of 1 day (for example, USDC / USD pair and DAI / USD pair). In the case of these pairs, the price would be considered stale after 3 hours, even though the price is still valid, therefore the users would not be able to use the protocol until the price is updated. Even then, they will have a guaranteed 3 hours where they can use protocol, but the rest of the time window between 3 and 24 hours may be unavailable for them.
This vulnerability can be used to deny service to the users, as the protocol would not allow them to use it in case the price is not updated for 3 hours. It may be specific only for some feeds, like the ones mentioned above, but beware of the market share of these tokens, as they are considered as stablecoins used widely in DeFi as collateral.
Manual review.
The check of the period elapsed between block.timestamp
and updatedAt
should be left in the code, as it does act as additional protection for stale prices, but the value of 3 hours should be reconsidered and changed based on the token which price is checked. Based on the above mentioned, in the case of USDC and DAI, the value should be => 24 hours. The following may be an example of the code that should be used:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.