fix sherlock-audit/2023-03-Y2K-judging#70

Y2K-Finance · Apr 11, 2023 · 2f51468 · 2f51468
1 parent acf4ce4
commit 2f51468
Show file tree

Hide file tree

Showing 2 changed files with 37 additions and 5 deletions.
diff --git a/src/v2/Controllers/ControllerPeggedAssetV2.sol b/src/v2/Controllers/ControllerPeggedAssetV2.sol
@@ -14,6 +14,7 @@ contract ControllerPeggedAssetV2 {
     IVaultFactoryV2 public immutable vaultFactory;
     AggregatorV2V3Interface internal sequencerUptimeFeed;
 
+    uint256 private constant MAX_UPDATE_TRESHOLD = 2 days;
     uint16 private constant GRACE_PERIOD_TIME = 3600;
     address public immutable treasury;
 
@@ -282,7 +283,8 @@ contract ControllerPeggedAssetV2 {
             ,
             /*uint80 roundId*/
             int256 answer,
-            uint256 startedAt, /*uint256 updatedAt*/ /*uint80 answeredInRound*/
+            uint256 startedAt, 
+            /*uint256 updatedAt*/ /*uint80 answeredInRound*/
             ,
 
         ) = sequencerUptimeFeed.latestRoundData();
@@ -303,8 +305,11 @@ contract ControllerPeggedAssetV2 {
         AggregatorV3Interface priceFeed = AggregatorV3Interface(
             vaultFactory.tokenToOracle(_token)
         );
-        (uint80 roundID, int256 price, , , uint80 answeredInRound) = priceFeed
+        (uint80 roundID, int256 price, ,uint256 updatedAt, uint80 answeredInRound) = priceFeed
             .latestRoundData();
+
+        if (updatedAt < block.timestamp - MAX_UPDATE_TRESHOLD) revert PriceOutdated();
+
         uint256 decimals = priceFeed.decimals();
 
         if (decimals < 18) {
@@ -362,6 +367,7 @@ contract ControllerPeggedAssetV2 {
     error EpochNotExpired();
     error VaultNotZeroTVL();
     error VaultZeroTVL();
+    error PriceOutdated();
 
     /*//////////////////////////////////////////////////////////////
                                  EVENTS

diff --git a/test/V2/Controllers/ControllerPeggedAssetV2Test.t.sol b/test/V2/Controllers/ControllerPeggedAssetV2Test.t.sol
@@ -10,6 +10,7 @@ import "../../../src/v2/VaultFactoryV2.sol";
 import "../../../src/v2/TimeLock.sol";
 
 contract ControllerPeggedAssetV2Test is Helper {
+    using stdStorage for StdStorage;
     VaultV2 vault;
     VaultV2 counterpartyVault;
     ControllerPeggedAssetV2 controller;
@@ -37,7 +38,7 @@ contract ControllerPeggedAssetV2Test is Helper {
 
         controller = new ControllerPeggedAssetV2(
            address(factory),
-           address(0x1),
+           address(new Sequencer()),
             TREASURY
         );
 
@@ -71,8 +72,8 @@ contract ControllerPeggedAssetV2Test is Helper {
             )
         );
 
-        begin = uint40(block.timestamp);
-        end = uint40(block.timestamp + 1 days);
+        begin = uint40(block.timestamp+ 30 days);
+        end = uint40(block.timestamp + 35 days);
         withdrawalFee = 10;
 
         (epochId, ) = factory.createEpoch(
@@ -89,6 +90,16 @@ contract ControllerPeggedAssetV2Test is Helper {
    function testTriggerDepeg() public {
         // TODO
         // revert cases
+        stdstore
+            .target(address(factory))
+            .sig("tokenToOracle(address)")
+            .with_key(TOKEN)
+            .checked_write(address(this)); // set oracle with faulty updated at time
+
+        vm.warp(begin + 1);
+
+        vm.expectRevert(ControllerPeggedAssetV2.PriceOutdated.selector);
+        controller.triggerDepeg(marketId, epochId);
 
         // success case
     }
@@ -108,4 +119,19 @@ contract ControllerPeggedAssetV2Test is Helper {
         // success case
     }
 
+    function latestRoundData() public view returns (uint80, int256, uint256, uint256, uint80) {
+        return (100, int256(STRIKE) - int256(1), 0, block.timestamp - 3 days, 100);
+    }
+
+    function decimals() public view returns (uint8) {
+        return 18;
+    }
+
+}
+
+
+contract Sequencer is Helper {
+    function latestRoundData() public view returns (uint80, int256, uint256, uint256, uint80) {
+        return (100, 0, block.timestamp - 1 days, block.timestamp, 100);
+    }
 }