Missing refund to the keeper in the PythOracle if they send extra native when commiting a price
Summary
The PythOracle calls parsePriceFeedUpdates() of the Pyth network contracts. with a fee as msg.value. The msg.value sent could be bigger than the required fee from pyth.getUpdateFee(updateDataList), which would leave the native stuck in the PythOracle.
Vulnerability Detail
The sent msg.value is not refunded if it is bigger than the pyth.getUpdateFee() call, leading to stuck native in the PythOracle contract.
Impact
Stuck native in PythOracle.
Code Snippet
Notice function _validateAndGetPrice(), which has no refund to the extra msg.value sent:
Return the fee from pyth.getUpdateFee() from function validateAndGetPrice() and refund the extra sent in the end of the commitRequested() and commit calls (to follow the checks-effects-interactions pattern).
0x73696d616f
medium
Missing refund to the
keeper
in thePythOracle
if they send extra native when commiting a priceSummary
The
PythOracle
callsparsePriceFeedUpdates()
of the Pyth network contracts. with a fee asmsg.value
. Themsg.value
sent could be bigger than the required fee frompyth.getUpdateFee(updateDataList)
, which would leave the native stuck in thePythOracle
.Vulnerability Detail
The sent
msg.value
is not refunded if it is bigger than thepyth.getUpdateFee()
call, leading to stuck native in thePythOracle
contract.Impact
Stuck native in
PythOracle
.Code Snippet
Notice function
_validateAndGetPrice()
, which has no refund to the extramsg.value
sent:Tool used
Vscode, Hardhat, Manual Review
Recommendation
Return the fee from
pyth.getUpdateFee()
from functionvalidateAndGetPrice()
and refund the extra sent in the end of thecommitRequested()
andcommit
calls (to follow the checks-effects-interactions pattern).Duplicate of #53