-
Notifications
You must be signed in to change notification settings - Fork 2
rvierdiiev - PriceOracle.getPrice doesn't check for stale price #9
Comments
Same with the answer to #25. |
Due to the off-chain system by Iron, issue can be a low. (Does not really affect the current state of the contracts) @ibsunhub Is it the right resolution, or thinking more about invalid? |
We still think this is invalid, thanks |
Because Iron's off-chain safeguard, invalid |
Escalate for 10 USDC
(2)It's right and should be encouraged for Watsons to point-out insufficient on-chain checks. The current code ignores any data freshness-related variables when consuming chainlink data, which is clearly not the best practice. And it's understandable that the protocol chose to implement such checks off-chain. But since Watsons wouldn't have known about this and that the code itself clearly has flaws. This should be at least low/informational. It's unfair for Watsons to be punished because of this. |
You've created a valid escalation for 10 USDC! To remove the escalation from consideration: Delete your comment. You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final. |
Result: |
Escalations have been resolved successfully! Escalation status:
|
Hi @hrishibhat @sherlock-admin |
Issue was labeled "Won't Fix" by protocol team. Categorizing as an acknowledged issue. |
rvierdiiev
medium
PriceOracle.getPrice doesn't check for stale price
Summary
PriceOracle.getPrice doesn't check for stale price. As result protocol can make decisions based on not up to date prices, which can cause loses.
Vulnerability Detail
PriceOracle.getPrice
function is going to provide asset price using chain link price feeds.https://github.com/sherlock-audit/2023-05-ironbank/blob/main/ib-v2/src/protocol/oracle/PriceOracle.sol#L66-L72
This function doesn't check that prices are up to date. Because of that it's possible that price is not outdated which can cause financial loses for protocol.
Impact
Protocol can face bad debt.
Code Snippet
Provided above
Tool used
Manual Review
Recommendation
You need to check that price is not outdated by checking round timestamp.
The text was updated successfully, but these errors were encountered: