Overlapping Price Ranges in RWADynamicOracle Contract

[code423n4]

Lines of code

https://github.com/code-423n4/2023-09-ondo/blob/47d34d6d4a5303af5f46e907ac2292e6a7745f6c/contracts/rwaOracles/RWADynamicOracle.sol#L212
https://github.com/code-423n4/2023-09-ondo/blob/47d34d6d4a5303af5f46e907ac2292e6a7745f6c/contracts/rwaOracles/RWADynamicOracle.sol#L214

Vulnerability details

Impact

The RWADynamicOracle contract allows for the setting of different price ranges with different daily interest rates. If the price ranges overlap due to incorrect validations, it can lead to incorrect price calculations, potentially affecting any system or protocol that relies on this oracle for pricing information.

Proof of Concept

In the overrideRange function, there's a potential issue with how the new start and end times for a range are validated against existing ranges.
Line #212: Here, the newStart should be strictly greater than the end time of the previous range. The current check is newStart < ranges[indexToModify - 1].end but it should be newStart > ranges[indexToModify - 1].end.
Line #214: Here, the newEnd should be strictly less than the start time of the next range. The current check is newEnd > ranges[indexToModify + 1].start but it should be newEnd < ranges[indexToModify + 1].start.

Tools Used

Manual Code Review

Recommended Mitigation Steps

Update the overrideRange function to ensure that the new start and end times for a range do not overlap with existing ranges.
Specifically, modify the checks on lines 212 and 214 as mentioned in the Proof of Concept section.

Assessed type

Context

[c4-pre-sort]

raymondfam marked the issue as primary issue

[c4-pre-sort]

raymondfam marked the issue as low quality report

[raymondfam]

Your assumptions would be correct if the conditional statements were using require statement.

Additionally, per the readme:

We are aware that if a range is updated the prevRangeClosePrice for subsequent set ranges will be stale.

[c4-judge]

kirk-baird marked the issue as unsatisfactory:
Invalid