Swaylend Protocol - Swaylend

When using third-party oracles, it is recommended to check the timestamp of a price feed against a staleness factor to avoid using a stale price that did not reflect the real value of the underlying asset. However, this is not done in the lending market in scope, which triggers serious issues as stated in the next section.

In Fuel, Pyth price feeds follow the next structure:

https://github.com/pyth-network/pyth-crosschain/blob/e3d8bfeff19906afc9640a52cadc165473560ff1/target_chains/fuel/contracts/pyth-interface/src/data_structures/price.sw#L20C1-L31C2

pub struct Price {
    // Confidence interval around the price
    pub confidence: u64,
    // Price exponent
    // This value represents the absolute value of an i32 in the range -255 to 0. Values other than 0, should be considered negative:
    // exponent of 5 means the Pyth Price exponent was -5
    pub exponent: u32,
    // Price
    pub price: u64,
    // The TAI64 timestamp describing when the price was published
    pub publish_time: u64,
}

to check the staleness of the price feed, the protocol using it must check for publish_time to not be too far in the past. However, it is not done in get_price_internal:

// # 10. Pyth Oracle management
#[storage(read)]
fn get_price_internal(price_feed_id: PriceFeedId) -> Price {
    let contract_id = storage.pyth_contract_id.read();
    require(contract_id != ZERO_B256, Error::OracleContractIdNotSet);
        
    let oracle = abi(PythCore, contract_id);
    let price = oracle.price(price_feed_id);
    price
}

As Pyth oracles follow a push behavior, where the price feed is not updated until a third actor updates it, then it is possible for users to "game" the market by interacting with it where the Pyth oracle returns a favorable price that does not reflect the real value of the asset, update it, and then gain advantage of it by interacting again /for example, borrowing more assets than the real value of its collateral.

Check publish_time to not be too far in the past against a staleness factor.

SOLVED: The code now checks for the price publish time to not be too far in the future nor in the past.

The get_price_internal function does not perform input validation on the price, confidence, and exponent values returned from the called price feed, which can lead to the contract accepting invalid or untrusted prices. Those values should be checked as clearly stated in the official documentation.

The function is as follows:

// # 10. Pyth Oracle management
#[storage(read)]
fn get_price_internal(price_feed_id: PriceFeedId) -> Price {
    let contract_id = storage.pyth_contract_id.read();
    require(contract_id != ZERO_B256, Error::OracleContractIdNotSet);
        
    let oracle = abi(PythCore, contract_id);
    let price = oracle.price(price_feed_id);
    price
}

which can be seen does not perform any type of input validation.

The function should revert the transaction if one of the following conditions is triggered:

• price == 0

• confidence > 0 && (price / confidence) < MIN_CONF_RATIO for a given MIN_CONF_RATIO

SOLVED: The recommended checks are now done in function get_price_internal.