Submission Details
Severity:
LibUsdOracle uses the same timeout for all Chainlink price feeds
Summary
If oracleImpl of certain token defines Chainlink, then Chainlink aggregator is used to return token price in USD. It uses 4 hour timeout for all such tokens.
However different tokens have different heartbeat, so it means that for certain tokens price will be unavailable because staleness is handled incorrectly.
Vulnerability Details
Here you can see it uses 4 hours:
function getTokenPriceFromExternal(
address token,
uint256 lookback
) internal view returns (uint256 tokenPrice) {
AppStorage storage s = LibAppStorage.diamondStorage();
Implementation memory oracleImpl = s.sys.oracleImplementation[token];
// If the encode type is type 1, use the default chainlink implementation instead.
// `target` refers to the address of the price aggergator implmenation
if (oracleImpl.encodeType == bytes1(0x01)) {
// if the address in the oracle implementation is 0, use the chainlink registry to lookup address
address chainlinkOraclePriceAddress = oracleImpl.target;
if (chainlinkOraclePriceAddress == address(0)) {
// use the chainlink registry
chainlinkOraclePriceAddress = ChainlinkPriceFeedRegistry(chainlinkRegistry).getFeed(
token,
0x0000000000000000000000000000000000000348
); // 0x0348 is the address for USD
}
return
uint256(1e24).div(
LibChainlinkOracle.getTokenPrice(
chainlinkOraclePriceAddress,
@> LibChainlinkOracle.FOUR_HOUR_TIMEOUT,
lookback
)
);
...
}
Impact
For tokens with 1 day heartbeat price will be unavailable most of the time: 20 hours a day.
Tools Used
Manual review
Recommendations
Configure timeout for every token.
Updates
Lead Judging Commences
inallhonesty 12 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
Known - Bean Part 1
Appeal created
T1MOH
12 months ago
T1MOH
12 months ago
inallhonesty
12 months ago
inallhonesty 11 months ago
Submission Judgement Published Assigned finding tags:
Using 4 hour heartbeat for USDC/USD chainlink price feed which has a 24 h heartbeat
Prize pool breakdown
Total prize
250,000 USDC
nSLOC
12,28520 USDC / LOC
220,000 USDC
10,000 USDC
20,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.