hats-finance / Convergence-Finance---IBO-0x0e410e7af8e70fc5bffcdbfbdf1673ee7b3d0777

IBO, Vesting & Bond mecanism repo prepared for Hat finance audit competition
0 stars 0 forks source link

Token prices aren't computed correctly #76

Open hats-bug-reporter[bot] opened 1 year ago

hats-bug-reporter[bot] commented 1 year ago

Github username: @marcobesier Submission hash (on-chain): 0x4bfe1e8b973ba8f26fa69787cf016a60363e16f49645088e3fba6559de4b6719 Severity: medium

Description: Description\ While I didn't make any changes to the codebase, the "Should compute Token prices in $" test in test/mocked-assets/Oracles/CvgOracle/oracle-test.js suddenly started to return the following AssertionError:

  155 passing (47s)
  1 failing

  1) Oracle Testing
       Should compute Token prices in $ :
     AssertionError: expected 1.9188100775482895 to be close to 1.79 +/- 0.0716
      at Context.<anonymous> (test/mocked-assets/Oracles/CvgOracle/oracle-test.js:112:27)
      at runMicrotasks (<anonymous>)
      at processTicksAndRejections (node:internal/process/task_queues:96:5)

I ran the test suite multiple times, and the issue continued to persist. My git diff is clear.

Attack Scenario\ Since this issue suddenly occurred with no changes in the codebase, I, unfortunately, can't provide a reproducible attack here other than running the existing test suite multiple times.

Attachments

  1. Proof of Concept (PoC) File

    The existing code base.

  2. Revised Code File (Optional)

marcobesier commented 1 year ago

Update: Still didn't change anything but the test is now passing again. I guess the delta used in the test is simply smaller than the actual price fluctuations. Therefore, I assume that this is indeed a problem because the delta value in the test wasn't chosen by accident and is, in practice, violated sometimes.

marcobesier commented 1 year ago

Update: Again, no change, but the test is failing again.

shalbe-cvg commented 1 year ago

Hello, Thanks a lot for your attention.

This case happens sometimes because CoinGecko returns an average price for an asset between different sources.

In conclusion we have so to consider this issue as invalid.