Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

The "MarketConfiguration::update" function lacks an update argument, potentially causing prices to be outdated.

0xcodex

Summary

The update function in the MarketConfiguration library is missing an argument found in the Data struct. This omission may result in the price information not being current. The update function should include and update the priceFeedHeartbeatSeconds argument with the parameters data.

Vulnerability Details

Traders may be unable to enter trades at their desired prices due to incorrect price information updates, potentially resulting in trading losses or a significant margin of error.

Impact

This significant oversight in the protocol undermines its trading purpose, causing traders to lose faith and interest, which could lead to substantial withdrawals of funds from the protocol.

Tools Used

Manuel Review

Recommendations

​
function update(Data storage self, Data memory params) internal {
self.name = params.name;
self.symbol = params.symbol;
self.priceAdapter = params.priceAdapter;
self.initialMarginRateX18 = params.initialMarginRateX18;
self.maintenanceMarginRateX18 = params.maintenanceMarginRateX18;
self.maxOpenInterest = params.maxOpenInterest;
self.maxSkew = params.maxSkew;
self.maxFundingVelocity = params.maxFundingVelocity;
self.minTradeSizeX18 = params.minTradeSizeX18;
self.skewScale = params.skewScale;
self.orderFees = params.orderFees;
+ self.priceFeedHeartbeatSeconds = params.priceFeedHeartbeatSeconds;
}
​
​
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`MarketConfiguration::update` function lacks `priceFeedHeartbeatSeconds` argument

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.