Summary

Wrong heartbeat used for the condition if oracle == baseOracle

Vulnerability Details

In the function getOraclePrice() of LibOracle.sol we can see that if the oracle == baseOracle then baseOracleCircuitBreaker() will be called. Now in this function if we look then we can see that the hearbeat of 2 hours has been used but instead the hearbeat if 1h. You can see it here.

Note: it is been mentioned in the known issues that the heatbeat has been intentionally set at 2h but this heartbeat is wrong and can cause wrong price, so it is recommended to use the one which is being used at chainlink

Impact

Using wrong HeartBeat can cause the wrong price to be used.

Tools Used

Manual Review

Recommendations

It is recommended to use correct heartBeat