You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA Medium severity issue.RewardA payout will be made for this issue
Hardcoded heartbeat duration for RedstoneOracle.sol returns stale price
Summary
The protocol uses RedstoneOracle for their prices. The issues lies within hardcoded STALE_PRICE_THRESHOLD which is also the heartbeat for the price feed.
Vulnerability Detail
The protocol mentioned in README.md that it will be deployed on any EVM. Looking at BNB chain, the heartbeat for a popular token BTC is 1 minute. Checkout the Redstone Pricefeed which provides other tokens with heartbeat less than an hour.
function getValueInEth(address, uint256amt) externalviewreturns (uint256) {
//@audit if (priceTimestamp <block.timestamp- STALE_PRICE_THRESHOLD) revertRedstoneCoreOracle_StalePrice(ASSET);
// scale amt to 18 decimalsif (ASSET_DECIMALS <=18) amt = amt *10** (18- ASSET_DECIMALS);
else amt = amt /10** (ASSET_DECIMALS -18);
// [ROUND] price is rounded downreturn amt.mulDiv(assetUsdPrice, ethUsdPrice);
}
sherlock-admin4
changed the title
Icy Glass Narwhal - Hardcoded heartbeat duration for RedstoneOracle.sol returns stale price
eeshenggoh - Hardcoded heartbeat duration for RedstoneOracle.sol returns stale price
Sep 15, 2024
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA Medium severity issue.RewardA payout will be made for this issue
eeshenggoh
Medium
Hardcoded heartbeat duration for
RedstoneOracle.sol
returns stale priceSummary
The protocol uses RedstoneOracle for their prices. The issues lies within hardcoded
STALE_PRICE_THRESHOLD
which is also the heartbeat for the price feed.Vulnerability Detail
The protocol mentioned in README.md that it will be deployed on any EVM. Looking at BNB chain, the heartbeat for a popular token BTC is 1 minute. Checkout the Redstone Pricefeed which provides other tokens with heartbeat less than an hour.
Impact
Stale prices is returned
Code Snippet
https://github.com/sherlock-audit/2024-08-sentiment-v2/blob/25a0c8aeaddec273c5318540059165696591ecfb/protocol-v2/src/oracle/RedstoneOracle.sol#L64
Tool used
Manual Review
Recommendation
Ensure that
STALE_PRICE_THRESHOLD
or the heartbeat is not hardcoded.Duplicate of #126
The text was updated successfully, but these errors were encountered: