search

lindy-labs / opus_contracts

Opus Source Code
https://opus.money
Other
0 stars 0 forks source link

fix: allow zero price in shrine #556

Closed tserg closed 9 months ago

tserg commented 9 months ago

Partially addresses L-02 of https://github.com/code-423n4/2024-01-opus-findings/issues/85

tserg commented 9 months ago

Related to the L-02 issue - I wonder if we should treat price updates of permanently suspended yangs differently? 🤔

Yes, if we disregard the value of permanently suspended yangs, then I think we should skip price updates once the yang is permanently suspended - I have opened #555 for this.

milancermak commented 9 months ago

Nice work on #555.

I think we can merge this and deal with price of 0 in #503 - if the price will gradually approach zero, then it's valid (and we'll probably suspend the yang before that). If it's going to be an sudden jump (doesn't matter why), the price update should be disregarded or dealt with in a different fashion. To be concluded in #503 :)

milancermak commented 9 months ago

Forgot to post a gif, so here it is :)

tserg commented 9 months ago

Note: I considered whether zero price yangs should be skipped when iterating over the yangs in redistribute_helper, and I think we should not because (1) the logic still works if zero debt is distributed for the yang; and (2) if the price is wrongly set to 0 (this could be dependent on #503) and subsequently recovers, then it could potentially incentivize manipulation of the oracle, although this would be unlikely because there would be easier attack vectors if they could do so.