Lively Glossy Goat - Attacker will redeem tokens at stale prices

[sherlock-admin2]

Lively Glossy Goat

High

Attacker will redeem tokens at stale prices

Summary

There are no staleness checks on the pyth oracle used to value tokens, which will lead to attackers using very stale prices at the expense of other participants.

Root Cause

In PythOracle.sol:98, the oracle is using getPriceUnsafe() which does not have any staleness checks, and could potentially return the very first oracle value (assuming there have been no updates since then).

Internal Pre-conditions

1. The PriceOracleAggregator needs to have been configured to use a PythOracle

External Pre-conditions

1. The PythOracle's feed will need to not have been updated recently
2. The market price of the token has moved since the last Pyth feed update

Attack Path

1. A user that shouldn't be able to redeem tokens, because the price has moved against them, can still redeem, in spite of the liquidity check

Impact

Protocol insolvency, since the solvency checks will essentially be bypassed

PoC

No response

Mitigation

Use getPriceNoOlderThan() and store a max age for each Pyth oracle

[sherlock-admin2]

The protocol team fixed this issue in the following PRs/commits:
https://github.com/Mach-Finance/contracts/pull/8/files