DeFiHardhat
35,000 USDC
View results
Submission Details
Severity: low
Invalid

Chainlink oracle returns stale price due to FOUR_DAY_TIMEOUT variable in LibChainlinkOracle being set to 4 days

Summary

When calling the WSTETH_ETH_CHAINLINK_PRICE_AGGREGATOR (0x86392dC19c0b719886221c78AB11eb8Cf5c52812, which is actually the stEth-Eth chainlink aggregator) to determne the stEth - Eth price, the FOUR_DAY_TIMEOUT constant is used to determine if the returned price is stale or not. FOUR_DAY_TIMEOUT is set to 345600 seconds (4 days) which is four times longer than the Chainlink heartbeat of the WSTETH_ETH_CHAINLINK_PRICE_AGGREGATOR, introducing a significant delay in recognizing stale or outdated price data.

Vulnerability Details

When the migration to wstETh is finished, during the process of minting new fertilizer, the function LibChainlinkOracle.checkForInvalidTimestampOrAnswer is called to determine if the price provided by the oracle is invalid:

function checkForInvalidTimestampOrAnswer(
uint256 timestamp,
int256 answer,
uint256 currentTimestamp,
uint256 maxTimeout
) private pure returns (bool) {
// Check for an invalid timeStamp that is 0, or in the future
if (timestamp == 0 || timestamp > currentTimestamp) return true;
// Check if Chainlink's price feed has timed out
if (currentTimestamp.sub(timestamp) > maxTimeout) return true;
// Check for non-positive price
if (answer <= 0) return true;
}

The function checks if the difference between the currentTimestamp and the timestamp is greater than maxTimeout to ensure the given answer is not stale:

if (currentTimestamp.sub(timestamp) > maxTimeout) return true;

The problem is that the used maxTimestamp is the constant FOUR_DAY_TIMEOUT which is 345.600 seconds (4 days) but the heartbeat of the WSTETH_ETH_CHAINLINK_PRICE_AGGREGATOR is only 1 day. This can result in a stale price not been recognized for 3 day.

Impact

The Chainlink heartbeat indicates the expected frequency of updates from the oracle. The Chainlink heartbeat on Ethereum for stEth/Eth is 86.400 seconds (1 day).

https://data.chain.link/feeds/ethereum/mainnet/steth-eth

The FOUR_DAY_TIMEOUT which is 345600 seconds (4 days).

Checking the staleness of the oracle answer using FOUR_DAY_TIMEOUT which is significantly longer than the heartbeat can lead to scenarios where the LibChainlinkOracle library accepts data that may no longer reflect current market conditions. Also, in volatile markets, a 4-day window leads to accepting outdated prices, increasing the risk of price slippage.

Tools Used

Manual Review

Recommendations

Reduce the FOUR_DAY_TIMEOUT to 1 day to align with the Chainlink heartbeat of the WSTETH_ETH_CHAINLINK_PRICE_AGGREGATOR on Ethereum, ensuring the received data is up to date and not stale.

Updates

Lead Judging Commences

giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Chainlink timeout

0x11singh99 Judge
about 1 year ago
giovannidisiena Lead Judge
about 1 year ago
giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Chainlink timeout

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.