DittoETH

Summary

The getPrice() function in the provided Solidity code retrieves the price of a specific asset from the contract's storage. However, the function does not perform any validation checks on the retrieved data, which could potentially lead to the use of uninitialized or stale price data.

Vulnerability Details

Impact

The getPrice() function retrieves the price data from the ercAmount field of the HEAD bid for the specified asset. If this field has not been properly initialized with valid price data, the function could return an incorrect price of zero.

Furthermore, the function does not check the age of the price data. If the price data is not regularly updated, the function could return stale price data that does not reflect the current market price of the asset.

Tools Used

MANUAL REVIEW

Recommendations

Implement a validation check in the getPrice() function to ensure that the price data is initialized:

uint256 price = s.bids[asset][Constants.HEAD].ercAmount;

require(price > 0, "Price not initialized");