Submission Details
Severity:
`LibWstethEthOracle.getWstethEthPrice()` uses too long `TIMEOUT`.
Summary
LibWstethEthOracle.getWstethEthPrice() uses 4 days TIMEOUT for oracles with a 1-day heartbeat.
Vulnerability Details
getWstethEthPrice() uses 4 days TIMEOUT and might accept outdated prices as the oracle has 1 day heartbeat.
function getWstethEthPrice(uint256 lookback) internal view returns (uint256 wstethEthPrice) {
uint256 chainlinkPrice = lookback == 0 ?
LibChainlinkOracle.getPrice(WSTETH_ETH_CHAINLINK_PRICE_AGGREGATOR, LibChainlinkOracle.FOUR_DAY_TIMEOUT) :
LibChainlinkOracle.getTwap(WSTETH_ETH_CHAINLINK_PRICE_AGGREGATOR, LibChainlinkOracle.FOUR_DAY_TIMEOUT, lookback);
}
Impact
LibWstethEthOracle.getWstethEthPrice() might return a stale price due to the long TIMEOUT.
Tools Used
Manual Review
Recommendations
Recommend using smaller TIMEOUT.
Updates
Lead Judging Commences
giovannidisiena over 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
Chainlink timeout
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
1,99118 USDC / LOC
30,000 USDC
1,500 USDC
3,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.