Beanstalk Part 2

Summary

The getUsdPrice function retrieves the price of a specified token in USD, with an optional parameter called lookback to determine the time window for calculating the Time-Weighted Average Price (TWAP). However, there is no check in the function to handle cases where the lookback parameter is set to a value less than or equal to 900 seconds, as recommended in the code comments. This oversight could potentially lead to price manipulation.

Code comments says:

Impact

If the lookback parameter is set to a value greater than 0 but less than or equal to 900 seconds, it opens up the possibility of price manipulation within that specific time window. For instance, a shorter time window allows potential hackers to influence the price within that period, leading to a manipulated price. This could undermine the reliability of the oracle and affect individuals relying on its price data for decision-making.

Recommendation

Implement a check in the getUsdPrice function to ensure that the lookback parameter is greater than 900 seconds, as advised in the code comments.

For example you can add a check like below: