Beanstalk Part 2

Summary

getEthUsdPrice() in LibEthUsdOracle.sol can return an outdated price because of a wrong Heartbeat.

Heartbeat that is used is hardcoded at 4 hours and the real one is at 1 hour.

Vulnerability Details

getEthUsdPrice() is a very important function that returns the price of ETH against the dollar:

Using for Heartbeat:

But this Heartbeat is for 4 hours and the real one we can see from the Chainlink website is updated every hour.

Reference - > https://data.chain.link/feeds/ethereum/mainnet/eth-usd

Impact

Because of wrong Heartbeat function will return outdated price of ETH/USD.

The same problem exists in the other getEthUsdPrice() function below.

Tools Used

Visual Studio Code

Recommendations

Change Heartbeat to one hour.