Skip to content

Latest commit

 

History

History
48 lines (23 loc) · 2.12 KB

062.md

File metadata and controls

48 lines (23 loc) · 2.12 KB

Stable Pastel Carp

Medium

Hardcoded staleness limit will cause frequent transaction failures when using Pyth oracles

Summary

The hardcoded staleness limit of 600 seconds in DebitaPyth.sol:getThePrice() is too restrictive for many tokens using Pyth oracles. This will cause frequent transaction failures for users, as token price updates often exceed this limit due to slower update intervals in Pyth's ecosystem.

Root Cause

In DebitaPyth.sol:getThePrice(), the choice to hardcode a staleness limit of 600 (code comment says 90 seconds which is much lower) seconds in the call to pyth.getPriceNoOlderThan() maybe too low, as Pyth oracle updates for many tokens are less frequent, leading to unnecessary transaction reverts. This can be observed here.

At the time of the writing the report the following feed gave the Error: StalePrice() error on Base chain with 600 seconds limit but successfully return the price when set to 1000: Crypto.XRP/USD (0xec5d399846a9209f3fe5881d70aae9268c94339ff9817e8d18ff19fa05eea1c8).

It is worth noting that protocol prioritizes Chainlink oracles over Pyth but for some tokens when there is no feed in Chainlink, Pyth needs to be used. The above example is one(and many more, UNI on Fantom etc) such case where there is no XRP feed in Base chain from Chainlink.

https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/main/Debita-V3-Contracts/contracts/oracles/DebitaPyth.sol#L31-L35

Internal pre-conditions

No response

External pre-conditions

No price feed for the particular token on Chainlink so that protocol uses Pyth .

Attack Path

No response

Impact

Functions relying on getThePrice() will experience high failure rates for tokens with slower update intervals, rendering the function unreliable for matching orders causing user frustration and loss of trust in the protocol.

PoC

No response

Mitigation

Replace the hardcoded staleness limit with a dynamic parameter so that admins can adjust this parameter to suit the update intervals of specific token feeds.