096.md

Bald Honeysuckle Urchin

Medium

PythOracle::currentValue does not work as expected

Summary

The currentValue function retrieves price data from the Pyth Oracle but contains an incorrect comparison in the stale price check. This could lead to rejecting valid prices, potentially impacting the functionality of any contract relying on this method for price feeds.

Root Cause

The cause of this vulnerability is the check in lines 28-31 This check will only pass if price.publishTime less than block.timestamp - noOlderThan, which means stale price. The comparison uses < instead of >, resulting in rejection of prices that are within the acceptable age defined by noOlderThan. This incorrect logic treats recent, valid prices as stale.

Internal pre-conditions

The pythOracle.getPriceUnsafe(tokenId) function must return a valid IPyth.Price object containing the publishTime field.

External pre-conditions

No response

Attack Path

No response

Impact

1. Contracts using the currentValue function will behave incorrectly due to rejected valid prices.
2. Automated systems depending on these price feeds could experience failures, potentially leading to financial losses or stalled operations.
3. Since the function only allows stale prices, outdated or inaccurate price data could lead to incorrect calculations for swaps, resulting in a direct loss of user funds.

PoC

No response

Mitigation

Correct the stale price comparison logic to ensure valid prices are not incorrectly rejected. Update the condition as follows:

function currentValue() external view override returns (uint256) {
        IPyth.Price memory price = pythOracle.getPriceUnsafe(tokenId);
        require(
-           price.publishTime < block.timestamp - noOlderThan,
+           price.publishTime > block.timestamp - noOlderThan,
            "Stale Price"
        );
        return uint256(uint64(price.price));
    }