Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>d3-doma>Low findings>Stale oracle price risk
GeneralOverview
Findings
Critical (3)
Medium (1)
Low (6)Native tokens can remain stuck in some contracts foreverRegistrars can overwrite domain-name details of other registrarsAdd an integrated test suite for all cross-chain interactionsRegistrars can pass in expiry dates from the past when renewing domainsStale oracle price riskSecondary sales in the Marketplace will revert if the fee is not set correctly
Informational (2)
Threat ModelWhat are threat models?DomaForwarder.solDomaRecordProxyFacet.solDomaRecordRegistrarClaimFacet.solDomaRecordRegistrarFacet.solERC7786GatewayReceiver.solERC7786GatewaySource.solMarketplace.solOwnershipToken.solProxyDomaRecord.sol
Audit ResultsAssessment Results
Category: Business Logic

Stale oracle price risk

Low Impact
Low Severity
Low Likelihood

Description

This issue is related to price-data reliability. When the ProxyDomaRecord::getNativePrice function queries the USD price of native currency using the Chainlink oracle, validation logic to check whether the returned price data is stale is missing.

The current implementation simply retrieves the price without verifying timestamps or round IDs, creating substantial risk of using outdated price data.

Impact

This issue may result in inaccurate fees being charged.

Recommendations

It is recommended to add logic that verifies the timestamps of price data to resolve this issue.

Remediation

This issue has been acknowledged by D3, and a fix was implemented in commit 039b512d↗.

Zellic © 2025Back to top ↑