Average price calculation using `avgPrice` might revert.
Summary
In PriceCalculator contract, the price of a token is calculated by averaging Chainlink answers of latest 4 hours.
This reverts for frequently updating price feeds like ETH/USD on Arbitrum.
Vulnerability Details
Some of price feeds that The Standard protocol are updated frequently, some less than every 100 seconds.
For example, ETH/USD price feed on Arbitrum is the one that updates frequently, here's some rounds data:
| RoundID | Timestamp | Answer | Deviation(s) |
|---|---|---|---|
| 18446744073710039843 | 1703858328 | 236322351000 | - |
| 18446744073710039842 | 1703857878 | 236466280000 | 50 |
| 18446744073710039841 | 1703857788 | 236648366344 | 90 |
| 18446744073710039840 | 1703857698 | 236516900087 | 90 |
| 18446744073710039839 | 1703857638 | 236744994246 | 60 |
As you can see from the example above, it takes less than 100 seconds between two rounds.
If 4 hours of average data is being used, it means that rounds data are required, thus will query Chainlink price feed for 144 times which will revert.
Impact
The Standard protocol features will not be working because price calculation reverts.
Tools Used
Manual Review, Etherscan, Arbiscan
Recommendations
Having maximum number of rounds to query is recommended.
Lead Judging Commences
chainlink-minanswer
chainlink-minanswer
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.