000000 - The Redstone oracle can report stale prices

[sherlock-admin3]

000000

Medium

The Redstone oracle can report stale prices

Summary

The Redstone oracle can report stale prices

Vulnerability Detail

The Redstone oracle has a hard coded stale price threshold:

uint256 public constant STALE_PRICE_THRESHOLD = 3600;

The issue with that is that quite a few price feeds have a lower heartbeat than an hour. Especially on the BSC network which an EVM-compatible chain which as mentioned in the README, would be used, we can see that there are price feeds with a heartbeat of just a minute (https://docs.redstone.finance/docs/get-started/price-feeds).

Impact

The Redstone oracle can report stale prices

Code Snippet

https://github.com/sherlock-audit/2024-08-sentiment-v2/blob/25a0c8aeaddec273c5318540059165696591ecfb/protocol-v2/src/oracle/RedstoneOracle.sol#L19

Tool used

Manual Review

Recommendation

Each price feed must have its own heartbeat

Duplicate of #126

[samuraii77]

I will escalate later based on this comment as I am eligible to do so but for some reason, it does not let me escalate.

The issue should be valid and was invalidated as each asset has its own oracle and this can be changed. There is a question to the protocol in the README about this very scenario:

Q: Are there any hardcoded values that you intend to change before (some) deployments?
The following immutable might be modified before certain deployments: Timelock Duration Timelock Deadline MAX_QUEUE_LENGTH Max Position Assets Max Position Debt Pools

That value is clearly not included, thus we can not just assume that it will be changed. Issue should be a valid medium.

[AtanasDimulski]

Escalate,
Per the above comment

[sherlock-admin3]

Escalate,
Per the above comment

You've created a valid escalation!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[cvetanovv]

I will reject the escalation because it is the same as the main issue. The escalation there will decide if #126 and its duplicates will be valid.

This comment will be taken into consideration when making the decision - #290 (comment)

Planning to reject the escalation.

[Evert0x]

Result:
Invalid
Duplicate of #126

[sherlock-admin2]

Escalations have been resolved successfully!

Escalation status:

• AtanasDimulski: rejected