Using the same threshold for multiple price feeds causes potential DoS
Summary
UpdateWeightRunner uses the same oracleStalenessThreshold to fetch prices for all tokens. This could lead to DoS issues because not all oracles are designed to operate with the same threshold. Interestingly, there is a mapping in the storage that is never used:
Vulnerability Details
It’s important to note that the threshold should be assigned per oracle and for each asset individually. Having a shared threshold for all oracles is problematic, as different oracles for the same asset may have varying heartbeats.
Impact
Frequent DoS events
Prices that should be invalid may not trigger a revert, leading to incorrect values being used.
Tools Used
Manual Review
Recommendations
Carefully assign a specific threshold for each oracle being used.
Lead Judging Commences
invalid_oracle_same_threshold_for_assets_in_pool
This is by design, staleness is a strategy aspect: it requires all data to have been updated within n minutes. No more precision needed.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.