Zealous Black Grasshopper - Ignoring Confidence Interval for Price Validation

[sherlock-admin2]

Zealous Black Grasshopper

High

Ignoring Confidence Interval for Price Validation

Summary

The currentValue function fetches the price from pythOracle but does not validate it using the confidence interval provided by Pyth Network. According to Pyth's best practices, the price-confidence interval should be used to account for potential price inaccuracies and volatility. For scenarios requiring conservative pricing, such as calculating minimum acceptable prices or completing orders, the protocol should use:

There is documentation present that explain this problem in detail

Root Cause

No response

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

No response

PoC

No response

Mitigation

Incorporate confidence intervals into the price validation process:
Use price.price - price.conf and price.price + price.conf based on the needs of price to always favor protocol