feelereth - owner can repeatedly call the update() function to waste gas

[sherlock-admin]

feelereth

high

owner can repeatedly call the update() function to waste gas

Summary

There is no check that the new oracle provider passed to update() is different from the current one. This could allow the owner to repeatedly update to the same oracle to waste gas.

Vulnerability Detail

The oracles mapping stores the history of oracle providers. Each time update() is called, _updateCurrent() increments global.current and adds a new entry to the oracles mapping with the newProvider. This will emit an OracleUpdated event and modify storage even if newProvider is the same as the current provider. A malicious owner could call this in a loop to waste gas.

Impact

Wasted gas costs, increased storage costs, spamming the oracle, manipulating timestamps and confusing off-chain processes

Code Snippet

https://github.com/sherlock-audit/2023-07-perennial/blob/main/perennial-v2/packages/perennial-oracle/contracts/Oracle.sol#L13 https://github.com/sherlock-audit/2023-07-perennial/blob/main/perennial-v2/packages/perennial-oracle/contracts/Oracle.sol#L28-L29 https://github.com/sherlock-audit/2023-07-perennial/blob/main/perennial-v2/packages/perennial-oracle/contracts/Oracle.sol#L76-L80

Tool used

Manual Review

Recommendation

add a check in update():

[sherlock-admin]

2 comment(s) were left on this issue during the judging contest.

141345 commented:

d

panprog commented:

invalid because owner is trusted