Part 2

Summary

The UsdTokenSwapKeeper.checkLog() function uses block.timestamp instead of the log.timestamp in revert StreamsLookup call. It can lead to incorrect prices being used in the swap as the block timestamp may not accurately reflect the event emission time.

Vulnerability Details

In the UsdTokenSwapKeeper.checkLog() function, when requesting price data through Chainlink's Data Streams, the code uses block.timestamp as the timestamp parameter in the StreamsLookup revert call:

However, Chainlink's recommended implementation specifically uses log.timestamp:

The block.timestamp represents the time when the block containing the transaction is mined, while log.timestamp represents the actual time when the event was emitted.

Impact

Swaps executes at incorrect prices.

Tools Used

Manual Review, VSCode

Recommendations

Modify the checkLog function to use log.timestamp instead of block.timestamp in the StreamsLookup revert