QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

`_getData()` may revert even for fresh oracle data due to strict inequality check

heavenz52

QuantAMMWeightedPool defines the oracleStalenessThreshold as the maximum amount of time that an oracle can be stale.

///@dev the maximum amount of time that an oracle **can be** stale.
uint oracleStalenessThreshold;
​

This means, when the threshold is set to say 5, a result generated by the oracle at block.timestamp - 5 is allowed (it can be 5 seconds old) like the natspec says.

However, in QuantAMMWeightedPool::_getData() we see that in the below snippet due to the strict inequality data that is allowed by the threshold would not pass the check and therefore it would end up reverting.

if (oracleResult.timestamp > block.timestamp - oracleStalenessThreshold) {
...
} else {
...
for (...) {
....
if (oracleResult.timestamp > block.timestamp - oracleStalenessThreshold) {
...
}
}
...
}
​

Recommended Mitigations:

Do a non strict inequality check in both places

- if (oracleResult.timestamp > block.timestamp - oracleStalenessThreshold) {
+ if (oracleResult.timestamp >= block.timestamp - oracleStalenessThreshold) {
​
Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas / Admin is trusted / Pool creation is trusted / User mistake / Suppositions

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.