Summary

Dangerous usage of block.timestamp in several functions. block.timestamp can be manipulated by miners.

Vulnerability Details

contracts/libraries/LibOracle.sol#64-110

LibOracle.baseOracleCircuitBreaker(uint256,uint80,int256,uint256,uint256) uses timestamp for comparisons:

contracts/libraries/LibOracle.sol#112-126

LibOracle.oracleCircuitBreaker(uint80,uint80,int256,int256,uint256,uint256) uses timestamp for comparisons

contracts/libraries/LibOrders.sol#39-57

LibOrders.increaseSharesOnMatch(address,STypes.Order,MTypes.Match,uint88) uses timestamp for comparisons

contracts/libraries/LibOrders.sol#891-903

LibOrders.updateOracleAndStartingShortViaTimeBidOnly(address,OF,uint16[]) uses timestamp for comparisons

Impact

The value of block.timestamp can be influenced by miners to a certain degree, so this may have some risk if miners collude on time manipulation to influence the value returned by these functions. This can lead of mismatched values and a wrong function of the protocol.

Tools Used

Slither

Recommendations

It is recommended to follow the 15-second rule, i.e., if the time-dependent event can vary by 15 seconds and maintain integrity, it is safe to use a block.timestamp. If possible, it is recommended to use Oracles.