eeshenggoh - Hardcoded heartbeat duration for RedstoneOracle.sol returns stale price

[sherlock-admin4]

eeshenggoh

Medium

Hardcoded heartbeat duration for RedstoneOracle.sol returns stale price

Summary

The protocol uses RedstoneOracle for their prices. The issues lies within hardcoded STALE_PRICE_THRESHOLD which is also the heartbeat for the price feed.

Vulnerability Detail

The protocol mentioned in README.md that it will be deployed on any EVM. Looking at BNB chain, the heartbeat for a popular token BTC is 1 minute. Checkout the Redstone Pricefeed which provides other tokens with heartbeat less than an hour.

    uint256 public constant STALE_PRICE_THRESHOLD = 3600; // 1 hour

    function getValueInEth(address, uint256 amt) external view returns (uint256) {
        //@audit 
        if (priceTimestamp < block.timestamp - STALE_PRICE_THRESHOLD) revert RedstoneCoreOracle_StalePrice(ASSET);

        // scale amt to 18 decimals
        if (ASSET_DECIMALS <= 18) amt = amt * 10 ** (18 - ASSET_DECIMALS);
        else amt = amt / 10 ** (ASSET_DECIMALS - 18);

        // [ROUND] price is rounded down
        return amt.mulDiv(assetUsdPrice, ethUsdPrice);
    }

Impact

Stale prices is returned

Code Snippet

https://github.com/sherlock-audit/2024-08-sentiment-v2/blob/25a0c8aeaddec273c5318540059165696591ecfb/protocol-v2/src/oracle/RedstoneOracle.sol#L64

Tool used

Manual Review

Recommendation

Ensure that STALE_PRICE_THRESHOLD or the heartbeat is not hardcoded.

Duplicate of #126