Beanstalk Part 2

Summary

Close to instantaneous queries to uniswap oracles should use 15 minute lookback.

Vulnerability Details

Inside LibWstethEthOracle.sol, here in function getWstethEthPrice() in given below lines.

uint256 uniswapPrice = LibUniswapOracle.getTwap(

lookback == 0 ? LibUniswapOracle.FIFTEEN_MINUTES :

uint32(lookback),

WSTETH_ETH_UNIV3_01_POOL, C.WSTETH, C.WETH, ONE );

When lookback == 0, then lookback is set to FIFTEEN_MINUTES (900 sec) but when lookback is in between (0-900 sec) it is passed as it is but here in LibUniswapOracle.sol It is clearly mentioned that // All instantaneous queries of Uniswap Oracles should use a 15 minute lookback.. I think lookback period is set to 15-minute to reduce the impact of short-term volatility on the reported price and provide a relatively stable view of the price trend.

Impact

For close to instantaneous values if lookback is not set to FIFTEEN_MINUTES (900 sec), Oracle would rely on instantaneous data, making it more sensitive to short-term price fluctuations and may provide inaccurate price information at the time of high volatility.
and here LibWstethEthOracle.so while calculating percent difference between chainlinkPrice and uniswapPrice It may become more than MAX_DIFFERENCE (1%) setting wstethEthPrice = 0.

Tools Used

Manual

Recommendations

If lookback value is less than FIFTEEN_MINUTES can be set to FIFTEEN_MINUTES (900 sec)

lookback < 900 ? LibUniswapOracle.FIFTEEN_MINUTES