PriceOracleReporter Manual Review Findings

POR-01M: Immediate Adjustment of Share Price

Type	Severity	Location
Logical Fault		PriceOracleReporter.sol:L67-L77

Description:

The PriceOracleReporter::update function permits the pricePerShare value to be updated by a trusted source to indicate a change in a RWA's evaluation as evidenced by the call-chain of tRWA::totalAssets invoking ReportedStrategy::balance which in turn relies on PriceOracleReporter::report.

The problem with the current approach is the fact that the tRWA::totalAssets value will immediately affect all conversion mechanisms of the underlying ERC4626, permitting a transaction that would abruptly affect the conversion rate to be arbitraged.

Impact:

Although somewhat mitigated via gated mechanisms for minting operations or withdrawals, the arbitrage opportunities do present themselves regardless of the restrictions set in place as the changes are abrupt.

Example:

Copy
62/**
63 * @notice Update the reported price per share
64 * @param newPricePerShare The new price per share to report (18 decimals)
65 * @param source_ The source of the price update
66 */
67function update(uint256 newPricePerShare, string calldata source_) external {
68    if (!authorizedUpdaters[msg.sender]) revert Unauthorized();
69    if (bytes(source_).length == 0) revert InvalidSource();
70
71    // Create new price update
72    currentRound++;
73    pricePerShare = newPricePerShare;
74    lastUpdateAt = block.timestamp;
75
76    emit PricePerShareUpdated(currentRound, pricePerShare, source_);
77}

Recommendation:

We advise the oracle's update mechanism to be significantly revised, enforcing maximum price deltas and a gradual price change between two price points as a function of time rather than an immediate adjustment.

Alleviation (e4d6885477):

The system was significantly refactored to accommodate for a gradual time-based price transition that follows a linear percentage based model.

We have validated that the revised system behaves as expected, however, we have observed two points that need consideration by the Sova Network team:

• It is possible to bypass the time-wise transition of a price by batching a large price change into multiple separate transactions that are reflected immediately
• An update of the max deviation will result in a change of the pricePerShare without an update of the lastUpdateAt value
• The pricePerShare notion continues to be utilized even though it should remain unused and replaced by the new transitionStartPrice and targetPricePerShare values

We invite the Sova Network team to evaluate these points and apply remediations as needed.

Alleviation (5816458210):

Based on our latest feedback, the Sova Network team revised the codebase to perform the following\:

• Maintain the total percentage-based delta applied in a particular period to prevent a bypass by splitting a large change across several transactions
• Update the lastUpdatedAt value if a change is observed during max deviation changes
• Remove the pricePerShare notion throughout the system as it was no longer necessary

As a result, we consider all concerns to have been addressed fully.