QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Stale Data Risks in `MultiHopOracle` Due to Use of Oldest Timestamp

brene

Summary

The _getData function in the MultiHopOracle contract aggregates data from multiple oracle sources and returns the minimum timestamp among them. This approach, while ensuring data consistency, may not align with user expectations for obtaining the most recent data.

Vulnerability Details

The _getData function currently selects the minimum timestamp from all oracle data points

function _getData() internal view override returns (int216 data, uint40 timestamp) {
HopConfig memory firstOracle = oracles[0];
(data, timestamp) = firstOracle.oracle.getData();
if (firstOracle.invert) {
data = 10 ** 36 / data; // 10^36 (i.e., 1 with 18 decimals * 10^18) to get the inverse with 18 decimals.
// 10**36 is automatically precomputed by the compiler, no explicit caching needed
}
uint256 oracleLength = oracles.length;
​
for (uint i = 1; i < oracleLength; ) {
HopConfig memory oracleConfig = oracles[i];
(int216 oracleRes, uint40 oracleTimestamp) = oracleConfig.oracle.getData();
if (oracleTimestamp < timestamp) {
>> timestamp = oracleTimestamp; // Return minimum timestamp
}
​
// depends which way the oracle conversion is happening
if (oracleConfig.invert) {
data = (data * 10 ** 18) / oracleRes;
} else {
data = (data * oracleRes) / 10 ** 18;
}
unchecked {
++i;
}
}

This means the returned data reflects the oldest data point, not necessarily the most recent or relevant one.

Impact

The use of the oldest timestamp can lead to stale data being perceived as current, affecting financial decisions and Inaccurate data timestamps can lead to incorrect market reactions or decisions based on perceived outdated information.

Tools Used

Manual Review

Recommendations

Modify the function to return the maximum timestamp, ensuring the data reflects the most recent update across all oracles.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

invalid_MultiHopOracle_return_oldest_timestamp

Here we’re searching for the weakest element in the chain to know if we can trust the entire chain. That’s why we need the oldest timestamp to check if the all chain returns at least one staled data.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!