Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`MarketConfiguration.update()` doesn't update `priceFeedHeartbeatSeconds`.

bladesec

Github link

https://github.com/Cyfrin/2024-07-zaros/blob/d687fe96bb7ace8652778797052a38763fbcbb1b/src/perpetuals/leaves/MarketConfiguration.sol#L37

Summary

MarketConfiguration.update() doesn't update priceFeedHeartbeatSeconds.

Vulnerability Details

When updatePerpMarketConfiguration() is called to update the market configuration, it calls MarketConfiguration.update() with MarketConfiguration.Data.

But in update(), it doesn't update priceFeedHeartbeatSeconds.

function update(Data storage self, Data memory params) internal { //@audit priceFeedHeartbeatSeconds
self.name = params.name;
self.symbol = params.symbol;
self.priceAdapter = params.priceAdapter;
self.initialMarginRateX18 = params.initialMarginRateX18;
self.maintenanceMarginRateX18 = params.maintenanceMarginRateX18;
self.maxOpenInterest = params.maxOpenInterest;
self.maxSkew = params.maxSkew;
self.maxFundingVelocity = params.maxFundingVelocity;
self.minTradeSizeX18 = params.minTradeSizeX18;
self.skewScale = params.skewScale;
self.orderFees = params.orderFees;
}

So priceFeedHeartbeatSeconds will remain as 0 and getPrice() won't work properly.

try priceFeed.latestRoundData() returns (uint80, int256 answer, uint256, uint256 updatedAt, uint80) {
if (block.timestamp - updatedAt > priceFeedHeartbeatSeconds) {
revert Errors.OraclePriceFeedHeartbeat(address(priceFeed));
}

Impact

It's impossible to get prices from Chainlink.

Tools Used

Manual Review

Recommendations

update() should update priceFeedHeartbeatSeconds.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

`MarketConfiguration::update` function lacks `priceFeedHeartbeatSeconds` argument

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.