DittoETH
Ditto
DeFiFoundryOracle
55,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Insufficient staleness validation in LibOracle's oracleCircuitBreaker function

PTolev

Summary

The LibOracle.oracleCircuitBreaker function lacks validation for the heartbeat of both oracles.

Vulnerability Detail

The LibOracle.oracleCircuitBreaker function is responsible for validating both the getLatestData of the base oracle and the asset oracle. However, it currently lacks sufficient validation.

Impact

Loss of funds due to inadequate staleness checks for the asset's price.

Tool Used

Manual Review

Recommendation

Add heartbeat validation similar to that in the baseOracleCircuitBreaker function. This modification will help ensure proper validation of both oracles' heartbeats and enhance the security of the system.

bool invalidFetchData = roundId == 0 || timeStamp == 0
+ || block.timestamp > 2 hours + timeStamp
+ || block.timestamp > 2 hours + baseTimeStamp
|| timeStamp > block.timestamp || chainlinkPrice <= 0 || baseRoundId == 0
|| baseTimeStamp == 0 || baseTimeStamp > block.timestamp
|| baseChainlinkPrice <= 0;
Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Known issues
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-644

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.