oracleMultiply / oracleDivide prices may be from different rounds #46
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Something isn't working
duplicate
This issue or pull request already exists
invalid
This doesn't seem right
out of scope
Comments
code423n4
added
2 (Med Risk)
|
Duplicate of #179 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Lines of code
https://github.com/code-423n4/2022-08-frax/blob/b58c9b72f5fe8fab81f7436504e7daf60fd124e3/src/contracts/FraxlendPairCore.sol#L524
https://github.com/code-423n4/2022-08-frax/blob/b58c9b72f5fe8fab81f7436504e7daf60fd124e3/src/contracts/FraxlendPairCore.sol#L532
Vulnerability details
Impact
When both
oracleMultiplyandoracleDivideare used, it can happen that the returned oracle results are from different rounds / have a different age. This can lead to situations where an exchange rate is used that never existed. Such a situation is much worse IMO than the (known) risk of outdated exchange rates, because they at least existed at some point in the past. But when one oracle returns a result that is 2 hours old and the other result is 5 minutes old, the calculated exchange rate may have never existed, but is still used.Recommended Mitigation Steps
Use the results from the same round, i.e. choose the minimum round instead of the latest round data when both oracles are used.
The text was updated successfully, but these errors were encountered: