ArmedGoose - Lack of staleness check in oracle consult() function

[sherlock-admin2]

ArmedGoose

medium

Lack of staleness check in oracle consult() function

Summary

The function consult() of TWAPOracleDollar3poolFacet.sol allows for getting a price information. However, the price is directly pulled from storage and there is zero guarantee, that the price meets any staleness criteria - there is also no logic that enables such check. Therefore, arbitrageurs may take advantage from stale price to buy assets at premium, at cost of the protocol, wherever the oracle is used further.

Vulnerability Detail

The core of the function, consult() in LibTWAPOracle.sol allows for retrieving the asset price in another token from the pool. However, there is no default or even optional staleness check - the price is retrieved from storage as it is. Due to this, it may be stale, but there is no option to verify it, or even check when the price was updated.

Impact

Arbitrageurs and users may take advantage from stale price to buy assets at premium, at cost of the protocol, wherever the oracle is used further.

Code Snippet

TWAPOracleDollar3poolFacet.sol::consult() calls LibTWAPOracle.sol::consult():

    function consult(address token) internal view returns (uint256 amountOut) {
        TWAPOracleStorage memory ts = twapOracleStorage();

        if (token == LibAppStorage.appStorage().dollarTokenAddress) {
            // price to exchange 1 Ubiquity Dollar to 3CRV based on TWAP
            amountOut = ts.price0Average;
        } else {
            require(token == ts.token1, "TWAPOracle: INVALID_TOKEN");
            // price to exchange 1 3CRV to Ubiquity Dollar based on TWAP
            amountOut = ts.price1Average;
        }
    }//@audit there is no actual check if the saved price is stale its just pulled from storage

Tool used

Manual Review

Recommendation

It is possible to check ts.pricesBlockTimestampLast value and add a condition to this function - if it doesn't meet a staleness threshold, which may be shared with chainlink staleness threshold or held in a separate variable - then force update.

[sherlock-admin2]

1 comment(s) were left on this issue during the judging contest.

auditsea commented:

It's view function, and during main logic, it is used only after the value is updated

[sherlock-admin2]

1 comment(s) were left on this issue during the judging contest.

auditsea commented:

It's view function, and during main logic, it is used only after the value is updated