Beanstalk: The Finale
Beanstalk
DeFiHardhatFoundry
250,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Ternary operator used give TWAP when asked for Spot price & vice versa

kalyansingh2

Summary

Wrong Ternary operator in LibChainlinkOracle.sol 's getTokenPrice.sol function returns spot price when asked for TWAP price of asset and vice versa

Vulnerability Details

/**
* @dev Returns the TOKEN/USD price with the option of using a TWA lookback.
* Use `lookback = 0` for the instantaneous price. `lookback > 0` for a TWAP.
* Return value has 6 decimal precision.
* Returns 0 if `priceAggregatorAddress` is broken or frozen.
**/
function getTokenPrice(
address priceAggregatorAddress,
uint256 maxTimeout,
uint256 lookback
) internal view returns (uint256 price) {
return
lookback > 0 ///@audit < incorrect conditional
? getPrice(priceAggregatorAddress, maxTimeout)
: getTwap(priceAggregatorAddress, maxTimeout, lookback);
}

in the highlighted line when lookback is greater than 0 as explained in the code comments should return a TWAP price but it just returns spot price.

Code snippet - https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/bd8d568215c19daf714899312db5fd1d13796a86/protocol/contracts/libraries/Oracle/LibChainlinkOracle.sol#L34-L48

Impact

Though chainlink oracles are pretty manipulation resistant it breaks a core functionality of the code which is accessing TWAP price when required

Tools Used

Manual Review

Recommendations

function getTokenPrice(
address priceAggregatorAddress,
uint256 maxTimeout,
uint256 lookback
) internal view returns (uint256 price) {
return
lookback > 0 ///@audit < now corrected
? getTwap(priceAggregatorAddress, maxTimeout, lookback);
: getPrice(priceAggregatorAddress, maxTimeout)
}
Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

getTokenPrice never gives TWAP

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.