Submission Details
Severity:
0 lookback for LibUsdOracle.getTokenPrice()
Summary
LibUsdOracle.getTokenPrice() doesn't utilize any lookback when fetching the price of WSTETH.
Vulnerability Details
Unlike for WETH, where a standard lookback is applied, for WSTETH, it employs a lookback of 0.
function getTokenPrice(address token, uint256 lookback) internal view returns (uint256) {
if (token == C.WETH) {
uint256 ethUsdPrice = LibEthUsdOracle.getEthUsdPrice(lookback);
if (ethUsdPrice == 0) return 0;
return ethUsdPrice;
}
if (token == C.WSTETH) {
uint256 wstethUsdPrice = LibWstethUsdOracle.getWstethUsdPrice(0);
if (wstethUsdPrice == 0) return 0;
return wstethUsdPrice;
}
revert("Oracle: Token not supported.");
}
Impact
This could lead to inaccuracies in the price calculation for WSTETH.
Tools Used
Manual Review
Recommendations
getTokenPrice() should use the lookback param instead of 0.
Updates
Lead Judging Commences
giovannidisiena
over 1 year ago
giovannidisiena over 1 year ago
Submission Judgement Published Assigned finding tags:
Unused lookback parameter
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
1,99118 USDC / LOC
30,000 USDC
1,500 USDC
3,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.