Reorgs could revert the setRange function and lead to a long lasting stale price of USDY

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-ondo/blob/47d34d6d4a5303af5f46e907ac2292e6a7745f6c/contracts/rwaOracles/RWADynamicOracle.sol#L158

Vulnerability details

Summary

Reorgs could revert the setRange function and therefore lead to stale prices for a long time (depending on the off chain protection, against it)

Vulnerability Details

Here is the setRange function of the USDY price oracle:

function setRange(
  uint256 endTimestamp,
  uint256 dailyInterestRate
) external onlyRole(SETTER_ROLE) {
  Range memory lastRange = ranges[ranges.length - 1];

  // Check that the endTimestamp is greater than the last range's end time
  if (lastRange.end >= endTimestamp) revert InvalidRange();

  uint256 prevClosePrice = derivePrice(lastRange, lastRange.end - 1);
  ranges.push(
    Range(lastRange.end, endTimestamp, dailyInterestRate, prevClosePrice)
  );
  emit RangeSet(
    ranges.length - 1,
    lastRange.end,
    endTimestamp,
    dailyInterestRate,
    prevClosePrice
  );
}

As we can see, the function will revert if lastRange.end >= endTimestamp. Depending on the time the setter calls this function and the duration of these ranges, a reorg could potentially lead to a revert of this function and if this is not recognized directly and could potentially lead to a long lasting stale price.

Impact

Long lasting stale price of the USDY price oracle, which could lead to a variety of problems

Tools Used

Manual Review

Recommendations

Use a duration instead of a fixed timestamp inside setRange, so that there is no need to check if lastRange.end > endTimestamp, because it will just set lastRange.end + duration as the next endTimestamp.

Assessed type

Oracle

[c4-pre-sort]

raymondfam marked the issue as low quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #495

[c4-judge]

kirk-baird marked the issue as unsatisfactory:
Invalid