Repository navigation
fix(H6): relax emergency de-risk bound under oracle degradation - #15
Merged
Merged
Conversation
Audit H6: every de-risk swap anchors minOut to OracleHub.ethUsdWad() x (1 - bound). When the Chainlink feed is stale the hub serves the last-good snapshot, which during a fast fall is above market; at the tight 150bps emergency bound the swap then can't fill on either tier and rebalance() reverts, bricking the permissionless de-risk during the exact crash it must run. Fix: the vault checks oracle health (it already holds healthSource) and, for an Emergency trigger while degraded, uses a wider 1000bps bound so the de-risk executes rather than reverting. Normal-condition emergencies keep the tight 150bps MEV protection. A swap can still revert if no venue fills within the widened bound, which is the market genuinely gapping past a fair exit (the >1/m case). Corrected the overstated 'never blocked' invariant comment. Regression tests: emergency de-risk survives a stale oracle + 3% execution cost; the tight bound still rejects the same fill when healthy. 116 -> 118.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Audit finding H6 (High)
De-risk swaps anchor
minOuttoOracleHub.ethUsdWad() x (1 - bound). When the feed is stale the hub serves the last-good snapshot (above market during a fast fall), and at the tight 150bps emergency bound the swap can't fill on either fee tier, sorebalance()reverts, bricking the permissionless de-risk during exactly the crash it must run.Fix
The vault already holds
healthSource. For an Emergency trigger while the oracle is degraded, it uses a wider 1000bps bound (EMERGENCY_DEGRADED_SLIPPAGE_BPS) so the de-risk executes instead of reverting; normal emergencies keep the tight 150bps MEV protection. Executing at a wider bound during a genuine feed outage beats not de-risking. A swap can still revert if no venue fills within the widened bound, which is the market genuinely gapping past a fair exit (the >1/m case). The overstated "never blocked" invariant comment is corrected to match.Tests
test_h6_emergencyDeRiskNotBrickedByStaleOracle: oracle stale + 3% execution cost on both tiers (exceeds 150bps, within 1000bps) -> emergency de-risk still executes and defends the floor.test_h6_tightBoundStillProtectsWhenHealthy: same 3% cost with a healthy oracle -> the tight bound rejects the fill (MEV protection preserved).Independent of the other fix PRs; branches off main. Suite 116 -> 118.