Beanstalk Part 2
Beanstalk
DeFiHardhat
35,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Inconsistency in `getTokenPrice` could lead to inaccurate price results

mrmorningstar

Summary

Function getTokenPrice have inconsistent data fetches of WETH and WSTETH could lead to various potential risks.

Vulnerability Details

The getWstethUsdPrice function uses a hardcoded 0 for the lookback parameter instead of the lookback argument passed to the getTokenPrice function.

function getTokenPrice(address token, uint256 lookback) internal view returns (uint256) {
if (token == C.WETH) {
uint256 ethUsdPrice = LibEthUsdOracle.getEthUsdPrice(lookback);
if (ethUsdPrice == 0) return 0;
return ethUsdPrice;
}
if (token == C.WSTETH) {
uint256 wstethUsdPrice = LibWstethUsdOracle.getWstethUsdPrice(0);
if (wstethUsdPrice == 0) return 0;
return wstethUsdPrice;
}
revert("Oracle: Token not supported.");
}

Impact

Potential for inconsistency in the data used for price calculations, could lead to inaccurate results. This could be problematic in scenarios where precise and up-to-date price information is critical. Inaccurate data processing and the risk of relying on outdated or inconsistent data for decision could lead to various issues especially in scenarios where it is important for current and future decision making.

Tools Used

Manual Review

Recommendations

function getTokenPrice(address token, uint256 lookback) internal view returns (uint256) {
if (token == C.WETH) {
uint256 ethUsdPrice = LibEthUsdOracle.getEthUsdPrice(lookback);
if (ethUsdPrice == 0) return 0;
return ethUsdPrice;
}
if (token == C.WSTETH) {
+ uint256 wstethUsdPrice = LibWstethUsdOracle.getWstethUsdPrice(lookback);
- uint256 wstethUsdPrice = LibWstethUsdOracle.getWstethUsdPrice(0);
if (wstethUsdPrice == 0) return 0;
return wstethUsdPrice;
}
revert("Oracle: Token not supported.");
}
Updates

Lead Judging Commences

giovannidisiena Lead Judge
about 1 year ago
giovannidisiena Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Unused lookback parameter

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.