Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Oracle RoundId Validation in KeeperProxy

hi_there

Summary

The KeeperProxy contract's _check() function relies solely on timestamp validation to prevent stale oracle prices. While the contract checks that the price update timestamp is within an acceptable window, this alone does not guarantee the price data is from the latest oracle round. The absence of roundId validation means the system could accept stale price data even when the timestamp check passes.

Vulnerability Details

The issue is that updatedAt > block.timestamp - maxTimeWindow[token] only verifies the age of the price data, not whether it's the latest round available from the oracle.

Impact

  • Use of outdated prices even when newer ones are available

  • Trading at incorrect prices

POC

  1. Oracle reports price data for roundId N

  2. Network congestion occurs

  3. Oracle updates to roundId N+1

  4. Due to congestion, the node serving the contract is still seeing roundId N

  5. System processes transactions using stale price data from roundId N

  6. Trades execute at incorrect prices

Tools Used

Manual Review

Recommendations

function _check(address token, uint256 price) internal view {
(uint80 roundID, int chainLinkPrice, , uint256 updatedAt, uint80 answeredInRound) = AggregatorV2V3Interface(dataFeed[token]).latestRoundData();
// check for both both timestamp and round freshness
require(updatedAt > block.timestamp - maxTimeWindow[token], "stale price feed");
require(answeredInRound >= roundID, "stale price round");
require(roundID > 0, "invalid round");
// ...
}
Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.