In staleCheckLatestRoundData
it is decided that the max TIMEOUT
is 3 hours
but there are a lot of data feeds that if the deviation threshold
is not hit then the heartbeat
is more than 3 hours.
In the current implementation, we have:
However, there are tokens with USD price feed's that the heartbeat
is more than 3 hours and the deviation threshold
more than 0.5%
that makes freezing the DSCEngine
highly likely.
There is a high probability to freeze DSCEngine
quite fast and make it unusable without serving its purpose.
Manual Review
There are a couple of recommendations.
One recommendation can be to allow only the tokens that can meet the requirements you have already set.
An other recommendation can be to loose a bit the TIMEOUT
constraint to 24 hours
to support a lot more USD pairs but also adding a try/catch
in staleCheckLatestRoundData
and otherwise use another fallback oracle solution.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.