141.md

Boxy Viridian Mink

medium

OptimismRewardCollector.getExpectedExchange might be reverted because of the heartbeat check is too strict.

Summary

After fetching price from the ChainlinkOracle, OptimismRewardCollector.getExpectedExchange checks the price' updateTime against 1200, if updateTime < block.timestamp - 1200 seconds the function will revert in OptimismRewardCollector.sol#L110-L112 and OptimismRewardCollector.sol#L128-L130. The issue is the chainlink's aggregator might update the price a little later than 1200 seconds, in such case, the OptimismRewardCollector.getExpectedExchange will get revert.

Vulnerability Detail

Take opToUsdOracle's aggregator 0x4F6dFDFd4d68F68b2692E79f9e94796fC8015770 as example. After download the all the tx and calcuating the time gap between every two Transmit, there are some txs's gap larger than 1200 seconds. For example the time gap between the two consecutive tx hash 0xb7eb224ce34aaa50359575c0f53052d01824bcbf8255da01974f663a6994fc17 and 0x2a8911bf189edd612e1e44582aebbde70361abbc95df19e961e5e066dde49fa3 is 606*2 = 1212 seconds.

Impact

Because OptimismRewardCollector.getExpectedExchange is called by RewardRouter.distributeRewards in RewardRouter.sol#L55, the revert will affect RewardRouter.distributeRewards

Code Snippet

https://github.com/sherlock-audit/2024-04-alchemix/blob/32e4902f77b05ea856cf52617c55c3450507281c/v2-foundry/src/utils/collectors/OptimismRewardCollector.sol#L110-L112 https://github.com/sherlock-audit/2024-04-alchemix/blob/32e4902f77b05ea856cf52617c55c3450507281c/v2-foundry/src/utils/collectors/OptimismRewardCollector.sol#L128-L130

Tool used

Manual Review

Recommendation

maybe change 1200 seconds to 1230 seconds