Closed sherlock-admin4 closed 5 months ago
1 comment(s) were left on this issue during the judging contest.
panprog commented:
valid medium, dup of #6
The protocol team fixed this issue in the following PRs/commits: https://github.com/equilibria-xyz/perennial-v2/pull/308
The Lead Senior Watson signed off on the fix.
bin2chen
high
OracleVersion will not be invalid
Summary
KeeperOracle._commitRequested()
has been modified so that iftimeout
takeslatestVersion price
, will not be0
. This will causeOracleVersion.valid
to always be trueVulnerability Detail
The code for
KeeperOracle._commitRequested()
after this version change is as follows:The above logic has been modified to take the last price after the timeout,
_prices[version.timestamp] = _prices[_global.latestVersion];
No moreprice=0
. But determining whether an oracle is valid is still determining whether it's 0 or not.This way the timeout
oralce
is modified to be valid and theoracle
becomes all valid. This breaks the logic that relied on theoralce
being invalid.Impact
OracleVersion will no longer be invalid, and market logic that relies on
oralce
to be invalid will all be incorrectCode Snippet
https://github.com/sherlock-audit/2024-02-perennial-v2-3/blob/main/perennial-v2/packages/perennial-oracle/contracts/keeper/KeeperOracle.sol#L158
Tool used
Manual Review
Recommendation
Suggestion, record timeout But note that there may be a problem if you use historical invalid prices, the earlier invalid price was
0
, notprevious price
.Duplicate of #6