QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Stale Oracle Prices Used When Only One Oracle Available

0xlandlady

Summary

In the UpdateWeightRunner contract, when there is only one oracle available for an asset, the backup oracle validation loop is skipped entirely due to starting at index 1, allowing stale prices to be used without proper validation. This can lead to incorrect weight calculations and unfavorable trading conditions due to a stale price being used.

Vulnerability Details

In the _getData function of UpdateWeightRunner.sol, if the primary oracle is stale there is a loop that checks backup oracles for stale data:

if (oracleResult.timestamp > block.timestamp - oracleStalenessThreshold) {
outputData[i] = oracleResult.data;
} else {
unchecked {
numAssetOracles = poolBackupOracles[_pool][i].length;
}
​
for (uint j = 1 /*0 already done via optimised poolOracles*/; j < numAssetOracles; ) {
oracleResult = _getOracleData(
OracleWrapper(poolBackupOracles[_pool][i][j])
);
if (oracleResult.timestamp > block.timestamp - oracleStalenessThreshold) {
// Oracle has fresh values
break;
} else if (j == numAssetOracles - 1) {
// All oracle results for this data point are stale. Should rarely happen in practice with proper backup oracles.
​
revert("No fresh oracle values available");
}
unchecked {
++j;
}
}
// ... existing code ...
}

The issue occurs because:

  1. The loop starts at index 1 since index 0 is meant to be the primary oracle

  2. When numAssetOracles is 1 (only primary oracle available), the loop condition j < numAssetOracles is false immediately

  3. This means no validation occurs on the primary oracle's data

  4. With no other way to revert the function will always use the stale price in cases where there is only one oracle.

With arbitrary tokens and oracles being used alongside arbitrary staleness thresholds this is likley to occur at times. Combine that with weight updates being limited to once per interval, once this happens the pool will be unable to update until the next interval and funds will be at risk during this time.

Impact

Loss of funds. The use of stale oracle prices can lead to:

  • Incorrect weight updates allowing favorable arbitrage conditions

  • Mispriced assets during withdrawals impacting LP share values

  • Unfair swap prices benefiting traders at the expense of LPs

Tools Used

Manual Review

Recommendations

Revert if the primary oracle is stale and there is only one oracle.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

invalid_stale_price_when_no_backup_oracles_set

Cyfrin audit: 7.2.4 Stale Oracle prices accepted when no backup oracles available

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.