DittoETH

Ditto
DeFiFoundryOracle
55,000 USDC
View results
Submission Details
Severity: low
Invalid

Twap time hardcoded to 30 minutes

Summary

Twap time is hardcoded to 30 minutes so instead of hardcoding take the time interval as perimeter.

Vulnerability Details

In the function baseOracleCircuitBreaker() twap time is hardcoded to 30 minutes which is not optimal in all cases cause even tho the twap is resilient to flashLoan but still it can be manipulated, there are websites that will tell you how much it takes to manipulate the twap price.

uint256 twapPrice = IDiamond(payable(address(this))).estimateWETHInUSDC(
Constants.UNISWAP_WETH_BASE_AMT, 30 minutes

This is the effected line,

Impact

Let user input the twap price instead of hardcoding as 30 minute timeframe is not optimal and ideal

Tools Used

Manual Review

Recommendations

It is recommended that instead of harcoding take the twap timeframe as input.

Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Vague generalities
nabeel Submitter
almost 2 years ago
0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Vague generalities

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.