Open sherlock-admin2 opened 11 months ago
4 comment(s) were left on this issue during the judging contest.
panprog commented:
borderline low/medium. The issue is valid and can force keepers to re-submit if they're frontrun. It's still always possible to submit a price with publishTime which is at MAX_VALID_TIME_AFTER_VERSION away from version time, but this still interfere oracle keepers process and increases chances of invalid version. Definitely not high, because it doesn't break things, just forces to re-submit transactions and keepers can also front-run each other, so reverted keep transactions are not something possible only due to this issue. Probably a better fix is to commitRequested instead of just commit if publishTime is between MIN and MAX valid time.
n33k commented:
invalid, expected behavior for commitRequested to revert because commit alreay provided the oracleVersion
0xyPhilic commented:
invalid because there is no proof of funds loss
polarzero commented:
Medium. Not sure what the incentive would be for an attacker to do this, and the impact it would have, but I'd rather have it downgraded than ignored.
bin2chen
high
commitRequested() front-run malicious invalid oralce
Summary
Both
commitRequested()
andcommit()
can modifylastCommittedPublishTime
, and both check that they cannotpythPrice.publishTime<=lastCommittedPublishTime
. This allows a malicious user to front-runcommitRequested()
to executecommit()
, causingcommitRequested()
to revert, invalid oralceVulnerability Detail
Execution of the
commitRequested()
method restricts thelastCommittedPublishTime
from going backward.commit()
has a similar limitation and can setlastCommittedPublishTime
.This leads to a situation where anyone can front-run
commitRequested()
and use hisupdateData
to executecommit()
. In order to satisfy thecommit()
constraint, we need to pass acommit()
parameter set as followsThis way
lastCommittedPublishTime
will be modified, causingcommitRequested()
to execute withrevert PythOracleNonIncreasingPublishTimes
Example: Given: nextVersionIndexToCommit = 10 versionList[10] = 200
_latestVersion = 100
when:
By the time the
keeper
submits the next VVA, the price may have passed its expiration dateImpact
If the user can control the oralce invalidation, it can lead to many problems e.g. invalidating
oracle
to one's own detriment, not having to take losses Maliciously destroying other people's profits, etc.Code Snippet
https://github.com/sherlock-audit/2023-09-perennial/blob/main/perennial-v2/packages/perennial-oracle/contracts/pyth/PythOracle.sol#L174
https://github.com/sherlock-audit/2023-09-perennial/blob/main/perennial-v2/packages/perennial-oracle/contracts/pyth/PythOracle.sol#L129
Tool used
Manual Review
Recommendation
check
pythPrice
whether valid fornextVersionIndexToCommit