_karanel - No way to update `maxOracleUpdateDurationFeed0` and `maxOracleUpdateDurationFeed1` outside of constructor, and could lead to DOS of the Valantis module due to falsely getting stale price #1
No way to update maxOracleUpdateDurationFeed0 and maxOracleUpdateDurationFeed1 outside of constructor, and could lead to DOS of the Valantis module due to falsely getting stale price
Summary
If feedToken0 and feedToken1 were not set in the constructor later proposed by manager using HOT::proposeFeeds() and set by liquidity provider using HOT::setFeeds, and the actual maxOracleUpdateDuration (or heartbeat, in case of chainlink price feeds) for any of the token is more than what was set in the constructor (could even be 0 if not supplied same as price feeds), it could lead to denial-of-service and even locking of funds.
Vulnerability Detail
Inside the HOTOracle::constructor if price feed of tokens (i.e. feedToken0 and feedToken1) are not set then we have an internal function HOTOracle::_setFeeds which is called by the public functionHOT::setFeeds which can be only used by the liquidity provider. HOT::setFeeds can only be called after the manager proposes price feeds to be set using HOT::proposeFeeds.
If while deployment of HOT contract price feeds of the tokens were not set, some value for _maxOracleUpdateDurationFeed0 and _maxOracleUpdateDurationFeed1 would still be set (could even be 0).
After the price feeds have been set, while retrieving price feed data for these tokens using HOTOracle::_getOraclePriceUSD, the contract might assume that the oracle is returning stale data and revert the transaction with error HOTOracle___getOraclePriceUSD_stalePrice.
This breaks core functionality of the valantis-hot module and leads to denial-of-service.
This could cause locking of funds (even permanently) by breaking HOT::setPriceBounds, HOT::depositLiquidity and HOT::getLiquidityQuote functions as they underneath call HOTOracle::getSqrtOraclePriceX96 function which internally calls HOTOracle::_getOraclePriceUSD function.
_karanel
high
No way to update
maxOracleUpdateDurationFeed0
andmaxOracleUpdateDurationFeed1
outside of constructor, and could lead to DOS of the Valantis module due to falsely getting stale priceSummary
If
feedToken0
andfeedToken1
were not set in the constructor later proposed by manager usingHOT::proposeFeeds()
and set by liquidity provider usingHOT::setFeeds
, and the actual maxOracleUpdateDuration (or heartbeat, in case of chainlink price feeds) for any of the token is more than what was set in the constructor (could even be0
if not supplied same as price feeds), it could lead to denial-of-service and even locking of funds.Vulnerability Detail
Inside the
HOTOracle::constructor
if price feed of tokens (i.e.feedToken0
andfeedToken1
) are not set then we have an internal functionHOTOracle::_setFeeds
which is called by the public functionHOT::setFeeds
which can be only used by the liquidity provider.HOT::setFeeds
can only be called after the manager proposes price feeds to be set usingHOT::proposeFeeds
.If while deployment of
HOT
contract price feeds of the tokens were not set, some value for_maxOracleUpdateDurationFeed0
and_maxOracleUpdateDurationFeed1
would still be set (could even be0
).After the price feeds have been set, while retrieving price feed data for these tokens using
HOTOracle::_getOraclePriceUSD
, the contract might assume that the oracle is returning stale data and revert the transaction with errorHOTOracle___getOraclePriceUSD_stalePrice
.https://github.com/sherlock-audit/2024-03-arrakis/blob/main/valantis-hot/src/HOTOracle.sol#L70-L90 https://github.com/sherlock-audit/2024-03-arrakis/blob/main/valantis-hot/src/HOTOracle.sol#L125-L149
Impact
valantis-hot
module and leads to denial-of-service.HOT::setPriceBounds
,HOT::depositLiquidity
andHOT::getLiquidityQuote
functions as they underneath callHOTOracle::getSqrtOraclePriceX96
function which internally callsHOTOracle::_getOraclePriceUSD
function.Code Snippet
https://github.com/sherlock-audit/2024-03-arrakis/blob/main/valantis-hot/src/HOTOracle.sol#L70-L90 https://github.com/sherlock-audit/2024-03-arrakis/blob/main/valantis-hot/src/HOTOracle.sol#L125-L149 https://github.com/sherlock-audit/2024-03-arrakis/blob/main/valantis-hot/src/HOT.sol#L217-L295 https://github.com/sherlock-audit/2024-03-arrakis/blob/main/valantis-hot/src/HOT.sol#L419-L428 https://github.com/sherlock-audit/2024-03-arrakis/blob/main/valantis-hot/src/HOT.sol#L514-L518
Tool used
Manual Review
Recommendation
Allow the manager to enter the maxOracleUpdateDuration (or heartbeat) when proposing price feeds, inside the
HOT::proposeFeeds
function.File: valantis-hot/HOTOracle.sol
File: valantis-hot/HOT.sol