Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Audit Fixes #6

Open
wants to merge 9 commits into
base: gas-price-oracle
Choose a base branch
from
Open

Audit Fixes #6

wants to merge 9 commits into from

Conversation

zobront
Copy link
Collaborator

@zobront zobront commented Jan 31, 2025

Price Applies Slippage

  • Changed to 1e9 for the quote, and multiply by 1e9 after to get to 18 decimals.
  • Perform the multiplication unchecked (with confirmation after) to avoid any risk of overflow revert.

Pool Paused

  • Check to confirm oracle.factory().paused() is false (with proper error handling to avoid revert).

Manipulate Price Across Blocks

  • This is really clearly invalid, would recommend you talk to someone who knows MEV and will be easy to verify. If you want to include no problem, but won't fix.

Fallback Price Check

  • Return a bool with teaPerETH() that is used for fallback check rather than equivalent prices.

Governance Token

  • Confirmed, TEA Governance will be on L2.

Sequencer Downtime

  • Acknowledged, won't fix. Not too worried about a couple blocks where this is underpriced.

No TeaPerETH Integrations

  • Added a @dev comment to make this clear.

Set Price Fallback Delay

  • Decided to change the minimum from 1 hour to 5 minutes (and hardcode), so no longer worried.

TWAP Constants

  • Changed minWethBalance to a variable.
  • Kept MAX_ORACLE_DOWNTIME as a constant, because can't imagine when we'd want to change that and not upgrade the contract.

Storage Namespace

  • Changed.

@zobront zobront force-pushed the audit-fixes branch 2 times, most recently from 2e40843 to a1784a0 Compare February 13, 2025 16:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant