Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Incorrect Time Comparison in Price Feed Validation

bhorprakash

Description

The require(updatedAt > block.timestamp - maxTimeWindow[token], "stale price feed"); condition incorrectly reverts for valid price updates when updatedAt is exactly at the edge of the maxTimeWindow.

function _check(address token, uint256 price) internal view {
// https://github.com/code-423n4/2021-06-tracer-findings/issues/145
(, int chainLinkPrice, , uint256 updatedAt, ) = AggregatorV2V3Interface(dataFeed[token]).latestRoundData();
@=> require(updatedAt > block.timestamp - maxTimeWindow[token], "stale price feed");
uint256 decimals = 30 - IERC20Meta(token).decimals();
price = price / 10 ** (decimals - 8); // Chainlink price decimals is always 8.
require(
_absDiff(price, chainLinkPrice.toUint256()) * BPS / chainLinkPrice.toUint256() < priceDiffThreshold[token],
"price offset too big"
);
}
​

Impact

The _check function unnecessarily rejects valid price updates that fall within the acceptable time window.
Potential disruptions in contract operations due to unnecessary reverts.
Reduced efficiency in executing trades or other dependent actions.

Recommendation

Change the strict > comparison to >= to correctly allow updates within the maxTimeWindow.

​
require(updatedAt >= block.timestamp - maxTimeWindow[token], "stale price feed");

This ensures that prices updated exactly at the limit of maxTimeWindow are still considered valid, preventing unnecessary reverts while maintaining data integrity.

Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.