Algo Ssstablecoinsss
AI First Flight #2
Beginner FriendlyDeFi
EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Hardcoded 72-Hour Oracle TIMEOUT Deviates from Feed Heartbeats, Permitting Operations on Stale Price Feeds

tinykitten

Summary

  • Impact: Medium

  • Affected File(s): src/oracle_lib.vy:L15, src/oracle_lib.vy:L47-L49

  • oracle_lib.vy hardcodes a constant TIMEOUT of 72 hours across all price feeds.

  • Standard Chainlink feeds on Ethereum and ZKsync Era have heartbeats of 1 hour or less, and the specification explicitly requires using feed heartbeats for staleness checks.

  • In the event of an oracle outage, stale prices are accepted for up to 3 days, exposing the protocol to stale price arbitrage and bad debt.

Vulnerability Details

Description

In oracle_lib.vy, price freshness is checked against a hardcoded constant:

@> TIMEOUT: constant(uint256) = 72 * 3600 # 72 hours (259,200 seconds)
​
@internal
@view
def _stale_check_latest_round_data(
price_price_address: address,
) -> (uint80, int256, uint256, uint256, uint80):
...
(
round_id, price, started_at, updated_at, answered_in_round
) = staticcall price_price.latestRoundData()
​
assert updated_at != 0, "DSCEngine_StalePrice"
assert answered_in_round >= round_id, "DSCEngine_StalePrice"
​
seconds_since: uint256 = block.timestamp - updated_at
@> assert seconds_since <= TIMEOUT, "DSCEngine_StalePrice"
​
return (round_id, price, started_at, updated_at, answered_in_round)

The protocol's NatSpec states:

"We want the DSCEngine to freeze if prices become stale. We should use the Chainlink feed heartbeat to determine if a feed is stale or not."

However, TIMEOUT is set to 72 hours universally. Standard Chainlink ETH/USD and BTC/USD feeds on ZKsync Era update every 1,200 to 3,600 seconds (20 to 60 minutes). If a feed stops updating, the engine continues processing minting, withdrawals, and liquidations with stale prices for up to 3 full days.

Risk

Likelihood: Medium

  • Triggered whenever an oracle node stalls, an L2 sequencer encounters downtime, or a feed encounters upstream aggregation delays past its heartbeat.

Impact: Medium

  • Stale prices can deviate substantially from actual market prices, allowing users to mint DSC against depreciated collateral or avoid legitimate liquidations.

Severity: Medium

Proof of Concept

def test_oracle_accepts_24_hour_stale_price(eth_usd):
# Oracle was last updated 24 hours ago (feed heartbeat is 1 hour)
one_day_ago = boa.env.timestamp - (24 * 3600)
eth_usd.setUpdatedTimestamp(one_day_ago)
# oracle_lib accepts the 24-hour-old price because TIMEOUT is 72 hours
round_id, price, started_at, updated_at, answered_in_round = (
oracle_lib._stale_check_latest_round_data(eth_usd.address)
)
assert updated_at == one_day_ago

Explanation: Even when an oracle is 23 hours past its expected heartbeat, seconds_since <= TIMEOUT evaluates to True, failing to freeze the protocol as intended.

Recommended Mitigation

Store each feed's specific heartbeat duration and validate freshness against its heartbeat plus an operational buffer:

-TIMEOUT: constant(uint256) = 72 * 3600
+FEED_HEARTBEATS: HashMap[address, uint256]
+
+@internal
+@view
+def _stale_check_latest_round_data(
+ price_price_address: address,
+) -> (uint80, int256, uint256, uint256, uint80):
+ ...
+ heartbeat: uint256 = self.FEED_HEARTBEATS[price_price_address]
+ seconds_since: uint256 = block.timestamp - updated_at
+ assert seconds_since <= heartbeat + 600, "DSCEngine_StalePrice"

Explanation: Enforcing staleness per-feed ensures each asset freezes when its own heartbeat fails, fulfilling the NatSpec requirement.

Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 1 hour ago
Submission Judgement Published
Validated
Assigned finding tags:

[M-01] The TIMEOUT is set as a fixed constant of 72 hours, which makes it inflexible in adapting to the market price.

## Description In this contract, the TIMEOUT is set as a fixed constant (72 hours, or 259200 seconds). This means that if the oracle price data is not updated within 72 hours, the data will be considered outdated, and the contract will trigger a revert. ## Vulnerability Details At this location in the code, <https://github.com/Cyfrin/2024-12-algo-ssstablecoinsss/blob/4cc3197b13f1db728fd6509cc1dcbfd7a2360179/src/oracle_lib.vy#L15> ```Solidity TIMEOUT: constant(uint256) = 72 * 3600 ``` the timeout is directly set to 72 hours. For an oracle, which cannot dynamically adjust the price updates, this is a suboptimal approach. ## Impact - Fixed Timeout: The TIMEOUT is hardcoded to 72 hours. In markets with frequent fluctuations or assets that require more frequent price updates, 72 hours might be too long. Conversely, if the timeout is too short, it could cause frequent errors due to the inability to update data in time, disrupting normal contract operations. - Non-adjustable Timeout: If the contract's requirements change (e.g., market conditions evolve or the protocol requires more flexibility), the fixed TIMEOUT cannot be dynamically adjusted, leading to potential mismatches with current needs. - Lack of Flexibility: The current timeout mechanism is static and cannot be adjusted based on market volatility or the frequency of oracle updates. In volatile markets, a shorter TIMEOUT might be necessary, while in stable markets, a longer timeout would be more appropriate. \##Tools Used Manual review ## Recommendations Introduce a dynamic price expiration mechanism that adjusts based on market conditions. Use volatility data (such as standard deviation or market price fluctuation) to dynamically adjust the timeout period. This can be achieved by monitoring market volatility and adjusting the TIMEOUT accordingly: ```Solidity # Monitor market volatility and dynamically adjust TIMEOUT @external def adjustTimeoutBasedOnVolatility(volatility: uint256): if volatility > HIGH_VOLATILITY_THRESHOLD: self.TIMEOUT = SHORTER_TIMEOUT # In high volatility, decrease TIMEOUT else: self.TIMEOUT = LONGER_TIMEOUT # In stable market, increase TIMEOUT log TimeoutAdjusted(self.TIMEOUT) ```

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!