Brief audit of `oracle.ride` - Githubissues

Tsunami-Exchange / tsunami-contracts

Tsunami Exchange Smart Contracts (RIDE)

2 stars 3 forks source link

Brief audit of `oracle.ride` #32

Open deemru opened 1 year ago

deemru commented 1 year ago

[ ] LOW: Built-in split works exactly like this: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/6c261e7538aeb00e4aa79b33493e97454ebcae1f/contracts/ride/oracle.ride#L43 https://github.com/Tsunami-Exchange/tsunami-contracts/blob/6c261e7538aeb00e4aa79b33493e97454ebcae1f/contracts/ride/oracle.ride#L60 https://github.com/Tsunami-Exchange/tsunami-contracts/blob/6c261e7538aeb00e4aa79b33493e97454ebcae1f/contracts/ride/oracle.ride#L194
[ ] LOW: verifyOraclePublicKeys verifies only list size: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/6c261e7538aeb00e4aa79b33493e97454ebcae1f/contracts/ride/oracle.ride#L48
[ ] LOW: Complexity: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/6c261e7538aeb00e4aa79b33493e97454ebcae1f/contracts/ride/oracle.ride#L30
[ ] LOW: Key intersection possible as no _id validation: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/6c261e7538aeb00e4aa79b33493e97454ebcae1f/contracts/ride/oracle.ride#L37-L39 https://github.com/Tsunami-Exchange/tsunami-contracts/blob/6c261e7538aeb00e4aa79b33493e97454ebcae1f/contracts/ride/oracle.ride#L97
[x] TRIVIAL: looks unused: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/6c261e7538aeb00e4aa79b33493e97454ebcae1f/contracts/ride/oracle.ride#L242
[x] CRITICAL (?): user can always use lastPrice (?) regardless of oracles data https://github.com/Tsunami-Exchange/tsunami-contracts/blob/6c261e7538aeb00e4aa79b33493e97454ebcae1f/contracts/ride/oracle.ride#L234-L235