Summary

self.last_block_number Not Initialized in Constructor

In the __init__ function, the variable self.last_block_number is missing an initial value. This omission allows the first execution of update_price to pass even if _block_number is far lower than the current block number, potentially leading to outdated or incorrect price updates.

Description

Affected Function:

The constructor initializes multiple parameters but does not set self.last_block_number.

Affected Code in update_price:

• Since self.last_block_number is not set during deployment, its initial value is undefined.

• On the first call to update_price, this assertion will pass even if _block_number is outdated, leading to incorrect price updates.

Impact

• Bypasses Block Number Check on First Update: Allows an outdated _block_number to be accepted.

• Potential Manipulation: Malicious prover could exploit this to use older price parameters.

• Inconsistent Price Updates: The system may start with an incorrect reference point, affecting future calculations.

Recommendation

Fix: Initialize self.last_block_number in the Constructor

Modify __init__ to include:

This ensures self.last_block_number starts with a valid reference and prevents outdated block numbers from being used during the first update.