-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
000000 - The Redstone oracle can report stale prices #290
Comments
I will escalate later based on this comment as I am eligible to do so but for some reason, it does not let me escalate. The issue should be valid and was invalidated as each asset has its own oracle and this can be changed. There is a question to the protocol in the README about this very scenario:
That value is clearly not included, thus we can not just assume that it will be changed. Issue should be a valid medium. |
Escalate, |
You've created a valid escalation! To remove the escalation from consideration: Delete your comment. You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final. |
I will reject the escalation because it is the same as the main issue. The escalation there will decide if #126 and its duplicates will be valid. This comment will be taken into consideration when making the decision - #290 (comment) Planning to reject the escalation. |
Result: |
Escalations have been resolved successfully! Escalation status:
|
000000
Medium
The Redstone oracle can report stale prices
Summary
The
Redstone
oracle can report stale pricesVulnerability Detail
The
Redstone
oracle has a hard coded stale price threshold:The issue with that is that quite a few price feeds have a lower heartbeat than an hour. Especially on the
BSC
network which an EVM-compatible chain which as mentioned in the README, would be used, we can see that there are price feeds with a heartbeat of just a minute (https://docs.redstone.finance/docs/get-started/price-feeds).Impact
The
Redstone
oracle can report stale pricesCode Snippet
https://github.com/sherlock-audit/2024-08-sentiment-v2/blob/25a0c8aeaddec273c5318540059165696591ecfb/protocol-v2/src/oracle/RedstoneOracle.sol#L19
Tool used
Manual Review
Recommendation
Each price feed must have its own heartbeat
Duplicate of #126
The text was updated successfully, but these errors were encountered: