Beanstalk Part 2

Summary

getPercentDifference() might return an unexpected result as it returns different outputs for (x, y) and (y, x).

Vulnerability Details

getPercentDifference() is used in getWstethEthPrice() to compare chainlinkPrice with uniswapPrice.

getWstethEthPrice() will return a completely different price if the price difference between chainlinkPrice and uniswapPrice is within 1% range or not.

But this function seems wrong as it calculates the difference differently for (x, y) and (y, x).

For example, if (chainlinkPrice, uniswapPrice) = (100, 101), the difference will be 1 - 100 / 101 = 0.99% and it will be handled inside the if clause in getWstethEthPrice().

But if (chainlinkPrice, uniswapPrice) = (101, 100), the difference will be 101 / 100 - 1 = 1% and it will be handled differently.

Impact

getWstethEthPrice() might return an incorrect result due to the inconsistent price difference calculation.

Tools Used

Manual Review

Recommendations

Recommend refactoring getPercentDifference() to return the same result for (x, y) and (y, x).