search

sherlock-audit / 2023-04-unitasprotocol-judging

4 stars 3 forks source link

PRAISE - XOracle.getLatestPrice() can return stale price within _getSwapResult() function #87

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

PRAISE

medium

XOracle.getLatestPrice() can return stale price within _getSwapResult() function

Summary

getLatestPrice() may not really return latest price

Vulnerability Detail

there's no check between the prev update timestamp and the current timestamp. The price returned can be a stale price when comparing real world price with what is returned by XOracle.getLatestPrice()

Impact

XOracle.getLatestPrice() can return stale price within _getSwapResult() function 

        price = oracle.getLatestPrice(priceQuoteToken);

Code Snippet

https://github.com/sherlock-audit/2023-04-unitasprotocol/blob/main/Unitas-Protocol/src/XOracle.sol#L58

Tool used

Manual Review

Recommendation

get the prev update timestamp and compare with the current timestamp, ensure a revert on stale prices by comparing the two timestamps within a require statement

Duplicate of #150