Decent Smoke Owl
High
The current price staleness check is incorrect. It verifies that the publish time is less than the last supported timestamp, whereas it should validate that the publish time is greater than the last supported timestamp.
In currentValue() function in PythOracle contract there is a check to ensure the price provided was updated in the last noOlderThan seconds. But it incorrectly uses < instead of >.
require(
price.publishTime < block.timestamp - noOlderThan,
"Stale Price"
);N/A
N/A
No attack path, it happens in normal workflows.
Only stale prices can be used. If price was updated recently, the protocol wont work as this function( used to calculate exchange rate between tokens) is going to revert.
N/A
Use > instead of <.