c4-bot-8 commented 5 months ago

Lines of code

https://github.com/code-423n4/2024-03-dittoeth/blob/91faf46078bb6fe8ce9f55bcb717e5d2d302d22e/contracts/libraries/UniswapOracleLibrary.sol#L59

Vulnerability details

Impact

I am leaving this for context: https://github.com/Uniswap/v3-periphery/issues/246

The observe call should be wrapped in a try-catch and be handled properly.

There is a good chance if in the future this function call is made with smaller pools that it will keep reverting for an unknown period and block bridge withdrawalFeePct() or block every main protocol function that uses getOraclePrice() when there is a price deviation.

Tools Used

Manual Review

Recommended Mitigation Steps

Wrap the call in a try-catch and handle the case accordingly if it reverts.

Assessed type

Oracle

c4-pre-sort commented 5 months ago

raymondfam marked the issue as sufficient quality report

c4-pre-sort commented 5 months ago

raymondfam marked the issue as primary issue

raymondfam commented 5 months ago

Could have been more elaborate and informational.

c4-sponsor commented 5 months ago

ditto-eth marked the issue as disagree with severity

ditto-eth commented 5 months ago

it will be clear to the DAO long before a call becomes revertable to upgrade the oracles. additionally, if the oracle call fails, users can still withdraw up to their credit amounts (excludes yield / trade gains) in the interim before a oracle update is released

c4-sponsor commented 4 months ago

ditto-eth (sponsor) disputed

c4-sponsor commented 4 months ago

ditto-eth marked the issue as agree with severity

hansfriese commented 4 months ago

I agree QA is more appropriate.

c4-judge commented 4 months ago

hansfriese changed the severity to QA (Quality Assurance)