Oracle periodSize = 0 which is as same as not using any oracle. #8
Labels
3 (High Risk)
Assets can be stolen/lost/compromised directly
bug
Something isn't working
duplicate
This issue or pull request already exists
sponsor acknowledged
Technically the issue is correct, but we're not going to resolve it for XYZ reasons
Lines of code
https://github.com/Plex-Engineer/lending-market-v2/blob/ea5840de72eab58bec837bb51986ac73712fcfde/contracts/Stableswap/BaseV1-core.sol#L72
Vulnerability details
Impact
Oracle periodSize = 0 which is as same as not using any oracle. It should be 1800 as expected (30 minutes).
Proof of Concept
You comment said that capture oracle reading every 30 minutes.
But in fact, periodSize = 0 which mean you are updating your oracle every block (TWAP window 1 block) which is as same as not using any oracle.
Tools Used
Diff checker
https://www.diffchecker.com/skDZcZJa
Recommended Mitigation Steps
periodSize = 1800;
1800 seconds = 30 minutes
The text was updated successfully, but these errors were encountered: