Beanstalk: The Finale

Summary

wrong implement of getTokenPrice.We are not implemented the loopback in correct way.

Vulnerability Details

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/main/protocol/contracts/libraries/Oracle/LibChainlinkOracle.sol#L45

getTwap should be used when there is a loopback and getprice should be used when there is no loopback.

function getTokenPrice(
address priceAggregatorAddress,
uint256 maxTimeout,
uint256 lookback
) internal view returns (uint256 price) {
return
@ >lookback > 0
? getPrice(priceAggregatorAddress, maxTimeout)
: getTwap(priceAggregatorAddress, maxTimeout, lookback);
}

Impact

wrong implement of getTokenPrice will get the wrong price.

Tools Used

Recommendations

function getTokenPrice(
address priceAggregatorAddress,
uint256 maxTimeout,
uint256 lookback
) internal view returns (uint256 price) {
return
@> lookback > 0
?getTwap(priceAggregatorAddress, maxTimeout, lookback)
: getPrice(priceAggregatorAddress, maxTimeout);
}