DeFiHardhatFoundry
250,000 USDC
View results
Submission Details
Severity: medium
Valid

LibUsdOracle uses the same timeout for all Chainlink price feeds

Summary

If oracleImpl of certain token defines Chainlink, then Chainlink aggregator is used to return token price in USD. It uses 4 hour timeout for all such tokens.
However different tokens have different heartbeat, so it means that for certain tokens price will be unavailable because staleness is handled incorrectly.

Vulnerability Details

Here you can see it uses 4 hours:

function getTokenPriceFromExternal(
address token,
uint256 lookback
) internal view returns (uint256 tokenPrice) {
AppStorage storage s = LibAppStorage.diamondStorage();
Implementation memory oracleImpl = s.sys.oracleImplementation[token];
// If the encode type is type 1, use the default chainlink implementation instead.
// `target` refers to the address of the price aggergator implmenation
if (oracleImpl.encodeType == bytes1(0x01)) {
// if the address in the oracle implementation is 0, use the chainlink registry to lookup address
address chainlinkOraclePriceAddress = oracleImpl.target;
if (chainlinkOraclePriceAddress == address(0)) {
// use the chainlink registry
chainlinkOraclePriceAddress = ChainlinkPriceFeedRegistry(chainlinkRegistry).getFeed(
token,
0x0000000000000000000000000000000000000348
); // 0x0348 is the address for USD
}
return
uint256(1e24).div(
LibChainlinkOracle.getTokenPrice(
chainlinkOraclePriceAddress,
@> LibChainlinkOracle.FOUR_HOUR_TIMEOUT,
lookback
)
);
...
}

Impact

For tokens with 1 day heartbeat price will be unavailable most of the time: 20 hours a day.

Tools Used

Manual review

Recommendations

Configure timeout for every token.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Known - Bean Part 1

Appeal created

T1MOH Submitter
11 months ago
T1MOH Submitter
11 months ago
inallhonesty Lead Judge
11 months ago
inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Using 4 hour heartbeat for USDC/USD chainlink price feed which has a 24 h heartbeat

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.