Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`LibChainlinkOracle.getTokenPrice()` gets a token price incorrectly

bladesec

Github link

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/9c7b9fd521ad7cbe65cc788df181887c0eb39c6d/protocol/contracts/libraries/Oracle/LibChainlinkOracle.sol#L45

Summary

getTokenPrice() will return an incorrect price because it checks for lookback wrongly.

Vulnerability Details

getTokenPrice() calculates a token price with the option of using a TWA lookback.

function getTokenPrice(
address priceAggregatorAddress,
uint256 maxTimeout,
uint256 lookback
) internal view returns (uint256 price) {
return
lookback > 0
? getPrice(priceAggregatorAddress, maxTimeout)
: getTwap(priceAggregatorAddress, maxTimeout, lookback);
}

But it gets a raw price for a positive lookback and uses a twap for 0 lookback. So it will return a wrong price with any lookback.

Impact

The protocol will use an incorrect token price when it calculates with a chainlink price feed.

Tools Used

Manual Review

Recommendations

We should fix like this.

function getTokenPrice(
address priceAggregatorAddress,
uint256 maxTimeout,
uint256 lookback
) internal view returns (uint256 price) {
return
- lookback > 0
+ lookback == 0
? getPrice(priceAggregatorAddress, maxTimeout)
: getTwap(priceAggregatorAddress, maxTimeout, lookback);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

getTokenPrice never gives TWAP

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.