{"componentChunkName":"component---node-modules-rocketseat-gatsby-theme-docs-core-src-templates-docs-query-js","path":"/manual-review/PriceOracleReporter-POR","result":{"data":{"mdx":{"id":"e1505931-94da-5c53-84dc-43997dcd3096","excerpt":"POR-01M: Immediate Adjustment of Share Price Type Severity Location Logical Fault PriceOracleReporter.sol:L67-L77 Description: The  PriceOracleReporter::update…","fields":{"slug":"/manual-review/PriceOracleReporter-POR/"},"frontmatter":{"title":"PriceOracleReporter Manual Review Findings","description":"Contains all the findings that relate to manual review on the contract codebase","image":null,"disableTableOfContents":null},"body":"var _excluded = [\"components\"];\n\nfunction _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }\n\nfunction _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }\n\nfunction _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }\n\n/* @jsxRuntime classic */\n\n/* @jsx mdx */\nvar _frontmatter = {\n  \"title\": \"PriceOracleReporter Manual Review Findings\",\n  \"description\": \"Contains all the findings that relate to manual review on the contract codebase\"\n};\nvar layoutProps = {\n  _frontmatter: _frontmatter\n};\nvar MDXLayout = \"wrapper\";\nreturn function MDXContent(_ref) {\n  var components = _ref.components,\n      props = _objectWithoutProperties(_ref, _excluded);\n\n  return mdx(MDXLayout, _extends({}, layoutProps, props, {\n    components: components,\n    mdxType: \"MDXLayout\"\n  }), mdx(\"h2\", {\n    \"id\": \"span-idpor-01mpor-01m-immediate-adjustment-of-share-pricespan\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h2\",\n    \"href\": \"#span-idpor-01mpor-01m-immediate-adjustment-of-share-pricespan\",\n    \"aria-label\": \"span idpor 01mpor 01m immediate adjustment of share pricespan permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), mdx(\"span\", {\n    id: \"POR-01M\"\n  }, \"POR-01M: Immediate Adjustment of Share Price\")), mdx(\"table\", null, mdx(\"thead\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"thead\"\n  }, mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Type\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Severity\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Location\"))), mdx(\"tbody\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/sova-network-fountfi-protocol-684adfa36579f5001821a219/appendix/finding-types#logical-fault\"\n  }, \"Logical Fault\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-medium\",\n    \"src\": \"https://omniscia.io/report-assets/medium.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/reporter/PriceOracleReporter.sol#L67-L77\"\n  }, \"PriceOracleReporter.sol:L67-L77\"))))), mdx(\"h3\", {\n    \"id\": \"description\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#description\",\n    \"aria-label\": \"description permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Description:\"), mdx(\"p\", null, \"The \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/reporter/PriceOracleReporter.sol#L67-L77\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"PriceOracleReporter::update\")), \" function permits the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"pricePerShare\"), \" value to be updated by a trusted source to indicate a change in a RWA's evaluation as evidenced by the call-chain of \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"tRWA::totalAssets\"), \" invoking \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/strategy/ReportedStrategy.sol#L75-L81\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"ReportedStrategy::balance\")), \" which in turn relies on \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/reporter/PriceOracleReporter.sol#L83-L85\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"PriceOracleReporter::report\")), \".\"), mdx(\"p\", null, \"The problem with the current approach is the fact that the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"tRWA::totalAssets\"), \" value will immediately affect all conversion mechanisms of the underlying \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"ERC4626\"), \", permitting a transaction that would abruptly affect the conversion rate to be arbitraged.\"), mdx(\"h3\", {\n    \"id\": \"impact\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#impact\",\n    \"aria-label\": \"impact permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Impact:\"), mdx(\"p\", null, \"Although somewhat mitigated via gated mechanisms for minting operations or withdrawals, the arbitrage opportunities do present themselves regardless of the restrictions set in place as the changes are abrupt.\"), mdx(\"h3\", {\n    \"id\": \"example\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#example\",\n    \"aria-label\": \"example permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Example:\"), mdx(\"pre\", null, mdx(\"code\", {\n    parentName: \"pre\",\n    \"className\": \"language-sol\",\n    \"metastring\": \"title=src/reporter/PriceOracleReporter.sol highlight={12} lineNumbers=true lineOffset=61\",\n    \"title\": \"src/reporter/PriceOracleReporter.sol\",\n    \"highlight\": \"{12}\",\n    \"lineNumbers\": \"true\",\n    \"lineOffset\": \"61\"\n  }, \"/**\\n * @notice Update the reported price per share\\n * @param newPricePerShare The new price per share to report (18 decimals)\\n * @param source_ The source of the price update\\n */\\nfunction update(uint256 newPricePerShare, string calldata source_) external {\\n    if (!authorizedUpdaters[msg.sender]) revert Unauthorized();\\n    if (bytes(source_).length == 0) revert InvalidSource();\\n\\n    // Create new price update\\n    currentRound++;\\n    pricePerShare = newPricePerShare;\\n    lastUpdateAt = block.timestamp;\\n\\n    emit PricePerShareUpdated(currentRound, pricePerShare, source_);\\n}\\n\")), mdx(\"h3\", {\n    \"id\": \"recommendation\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#recommendation\",\n    \"aria-label\": \"recommendation permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Recommendation:\"), mdx(\"p\", null, \"We advise the oracle's update mechanism to be significantly revised, enforcing maximum price deltas and a gradual price change between two price points as a function of time rather than an immediate adjustment.\"), mdx(\"h3\", {\n    \"id\": \"alleviation-e4d6885477\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#alleviation-e4d6885477\",\n    \"aria-label\": \"alleviation e4d6885477 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Alleviation (e4d6885477):\"), mdx(\"p\", null, \"The system was significantly refactored to accommodate for a gradual time-based price transition that follows a linear percentage based model.\"), mdx(\"p\", null, \"We have validated that the revised system behaves as expected, however, we have observed two points that need consideration by the Sova Network team:\"), mdx(\"ul\", null, mdx(\"li\", {\n    parentName: \"ul\"\n  }, \"It is possible to bypass the time-wise transition of a price by batching a large price change into multiple separate transactions that are reflected immediately\"), mdx(\"li\", {\n    parentName: \"ul\"\n  }, \"An update of the max deviation will result in a change of the \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"pricePerShare\"), \" without an update of the \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"lastUpdateAt\"), \" value\"), mdx(\"li\", {\n    parentName: \"ul\"\n  }, \"The \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"pricePerShare\"), \" notion continues to be utilized even though it should remain unused and replaced by the new \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"transitionStartPrice\"), \" and \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"targetPricePerShare\"), \" values\")), mdx(\"p\", null, \"We invite the Sova Network team to evaluate these points and apply remediations as needed.\"), mdx(\"h3\", {\n    \"id\": \"alleviation-5816458210\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#alleviation-5816458210\",\n    \"aria-label\": \"alleviation 5816458210 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Alleviation (5816458210):\"), mdx(\"p\", null, \"Based on our latest feedback, the Sova Network team revised the codebase to perform the following\\\\:\"), mdx(\"ul\", null, mdx(\"li\", {\n    parentName: \"ul\"\n  }, \"Maintain the total percentage-based delta applied in a particular period to prevent a bypass by splitting a large change across several transactions\"), mdx(\"li\", {\n    parentName: \"ul\"\n  }, \"Update the \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"lastUpdatedAt\"), \" value if a change is observed during max deviation changes\"), mdx(\"li\", {\n    parentName: \"ul\"\n  }, \"Remove the \", mdx(\"inlineCode\", {\n    parentName: \"li\"\n  }, \"pricePerShare\"), \" notion throughout the system as it was no longer necessary\")), mdx(\"p\", null, \"As a result, we consider all concerns to have been addressed fully.\"), mdx(ViewDiffButton, {\n    repoUrl: \"https://github.com/SovaNetwork/fountfi\",\n    mainHash: \"fca2fe922e699e8762410f40e249961b53c3bf92\",\n    fixHash: \"58164582109e1a7de75ddd7e30bfe628ac79d7fd\",\n    gitHubIssue: \"8\",\n    mdxType: \"ViewDiffButton\"\n  }));\n}\n;\nMDXContent.isMDXComponent = true;","headings":[{"depth":2,"value":"<span id=\"POR-01M\">POR-01M: Immediate Adjustment of Share Price</span>"},{"depth":3,"value":"Description:"},{"depth":3,"value":"Impact:"},{"depth":3,"value":"Example:"},{"depth":3,"value":"Recommendation:"},{"depth":3,"value":"Alleviation (e4d6885477):"},{"depth":3,"value":"Alleviation (5816458210):"}]}},"pageContext":{"slug":"/manual-review/PriceOracleReporter-POR/","prev":{"label":"ManagedWithdrawRWAStrategy.sol (MWW-M)","link":"/manual-review/ManagedWithdrawRWAStrategy-MWW"},"next":{"label":"Registry.sol (RYR-M)","link":"/manual-review/Registry-RYR"}}},"staticQueryHashes":["1954253342","2328931024","2501019404","973074209"]}