Summary

The following two issues are likely to cause significant deviations in the value of the user's acquisition of collateral tokens in dollars

Vulnerability Details

1. Check 01：The TIMEOUT value is set to 3 hours,The price used by the user may not be up to date, which may result in the value of the collateral on the user's account being misestimated

2. Check 02：updatedAt is not checked for data,When updatedAt = 0, secondsSince = block.timestamp,And block.timestamp may be manipulated maliciously. This can lead to potentially incorrect behavior.

3. Impact: This will directly and significantly impact the accuracy of the prices obtained from the getTokenAmountFromUsd and getUsdValue functions.

As shown in the figure:

Tools Used

Manual Review

Recommendations

1. Validate that updatedAt has been updated recently enough: 【PS：Reference： https://github.com/code-423n4/2023-02-kuma-findings/issues/11 】

2. It is not recommended to use 'block.timestamp' as a time proxy 【PS：Reference：Block values as time proxies 】

3. You are advised to set the value of TIMEOUT to 0.5 ~ 2 hours