Description:
get_price detects a stale price (timestamp older than staleness_threshold) and emits a StaleAlert event, but still returns the stale PriceData to the caller. Callers like MortgagePool and PropertyRegistry do not inspect the timestamp themselves. This means liquidation decisions and LTV calculations can be made on hours-old prices with no on-chain protection.
Expected behaviour:
get_price should either panic when the price is stale, or return a result type that forces callers to handle staleness explicitly. A separate get_price_unchecked can be offered for read-only display purposes.
Labels: security, contracts, oracle-adapter, high-priority
Description:
get_pricedetects a stale price (timestamp older thanstaleness_threshold) and emits aStaleAlertevent, but still returns the stalePriceDatato the caller. Callers likeMortgagePoolandPropertyRegistrydo not inspect the timestamp themselves. This means liquidation decisions and LTV calculations can be made on hours-old prices with no on-chain protection.Expected behaviour:
get_priceshould either panic when the price is stale, or return a result type that forces callers to handle staleness explicitly. A separateget_price_uncheckedcan be offered for read-only display purposes.Labels:
security,contracts,oracle-adapter,high-priority