Steadefi

Summary

getAmountsOut, getAmountsIn these functions retrieve an index price from the SyntheticReader response to calculate swap amounts. However, there is no guarantee this price corresponds to the timestamp of the trade execution.

Vulnerability Details

If the markets or oracle prices moved between the time of the SyntheticReader call and trade, an incorrect index value could be used for pricing.

Reproduction:

1. Call getAmountsOut/In and SyntheticReader returns stale price

2. Index moved before trade occurred

3. Incorrect amounts returned due to outdated reference

Tools Used

Manual Review

Recommendations

Consider caching index prices at function call time rather than rely on SyntheticReader response. Alternatively, pass trade timestamp to derive corresponding index level.