search

sherlock-audit / 2023-04-unitasprotocol-judging

4 stars 3 forks source link

PawelK - No check for oracle staleness #100

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

PawelK

medium

No check for oracle staleness

Summary

No check for oracle staleness

Vulnerability Detail

In getLatestPrice there is no check that the price is not stale. The price could be very old, and result in not favorable deal.

Impact

User fund loss due to stale price feed

Code Snippet


function getLatestPrice(address asset) public view returns (uint256) {
        require(block.timstamp - prices[asset].timestamp >= STALENESS_THRESHOLD, "stale price");
        return prices[asset].price;
    }

Tool used

Manual Review

Recommendation

Implement check for price staleness (1 day for example)

Duplicate of #150