DeFiHardhat
35,000 USDC
View results
Submission Details
Severity: low
Valid

Inconsistency in LibUsdOracle.getTokenPrice

Summary

The function LibUsdOracle.getTokenPrice() does not get into consideration the lookback variable for the C.WSTETH token. It uses always 0 even if the lookback variable has not zero value. For comparison LibUsdOracle.getUsdPrice() uses correctly the lookback variable for both C.WSTETH and C.WETH. In LibWstethEthOracle.getWstethEthPrice() can be seen that the function has lookback argument which means that it is an intended behavior to have use the lookback variable.

Vulnerability Details

Above

Impact

The protocol is not able to use the TWAP feature for wstETH which protects users from MEV manipulation attacks.

Tools Used

Manual review

Recommendations

Adjust the code to pass the lookback argument to LibWstethUsdOracle.getWstethUsdPrice instead of the hardcoded 0 value.

Updates

Lead Judging Commences

giovannidisiena Lead Judge
about 1 year ago
giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Unused lookback parameter

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.