Incorrect check of stale price can lead to DoS and the use of a stale price in the Ibo contract

[hats-bug-reporter[bot]]

Github username: @neumoxx Submission hash (on-chain): 0xfd049598e2336c8b8b1da4857b29d3a62b5db2f734a542092deab633b86fff66 Severity: high

Description:

Vulnerability Report

Description

Function _getAndVerifyOracleAndAggregatorPrices in the CvgOracle contract does an incorrect check for wether the price is stale or not. https://github.com/hats-finance/Convergence-Finance---IBO-0x0e410e7af8e70fc5bffcdbfbdf1673ee7b3d0777/blob/f43c5d9bc6b30c9f488e34836f09dc04d8f7361f/contracts/Oracles/CvgOracle.sol#L279-L293
The following line:

require(lastUpdateDate + oracleParams.maxLastUpdateAggregator > block.timestamp, "STALE_AGGREGATOR");

Is actually reverting when the price is NOT stale.

The line should instead be:

require(lastUpdateDate + oracleParams.maxLastUpdateAggregator < block.timestamp, "STALE_AGGREGATOR");

Attachments

1. Proof of Concept (PoC)

As seen above, all calls to _getAndVerifyOracleAndAggregatorPrices on a token with a non-stale price will revert. That means all functions that call it will also revert for non-stale prices. These are:

• getAndVerifyCvgPrice
• getAndVerifyOracleAndAggregatorTwoPrices
• getAndVerifyOracleAndAggregatorPrices

The first two are not called in the rest of the codebase (although they could cause problems in third party / front end integrations), but the last one is called in the deposit function of the Ibo contract.

https://github.com/hats-finance/Convergence-Finance---IBO-0x0e410e7af8e70fc5bffcdbfbdf1673ee7b3d0777/blob/f43c5d9bc6b30c9f488e34836f09dc04d8f7361f/contracts/PresaleVesting/Ibo.sol#L175-L179

This means all calls to deposit will revert for tokens with a non-stale price (and if the price is stale the call can succeed, with the dangers of using a stale price in a deposit).

[neumoxx]

I just saw I'm absolutely wrong in this report, apologies, you can move on to the next, nothing to see here 👎

[walk-on-me]

Hello, Yes , thanks a lot for your participation !