Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Initia>Threat Model>Module oracle.move
GeneralOverview
Findings
Critical (2)
High (7)
Medium (5)
Low (12)
Informational (5)
DiscussionGeneral DiscussionImprove AMM testsBridge executor minting powerCharge before using valuesEmpty allowed_publishers array allows every address to publishERC20Keeper with custom contractsSuggestions for additional security checksTable handle overflow leads to abort
Threat ModelWhat are threat models?
stdlibModule block.moveModule table.moveModule event.moveModule type_info.moveModules any.move and copyable_any.moveModule address.moveModule cosmos.moveModule multisig.moveModule object.moveModule transaction_context.moveModule debug.moveModule table_key.moveModule account.moveModule base64.moveModule hex.moveModule from_bcs.moveModule json.moveModule oracle.moveModule code.moveModule zapping.moveModule dex.moveModule reward.moveModule comparator.moveModule managed_coin.moveModules decimal128.move and decimal256.moveModule string_utils.move
Audit ResultsSummary
AppendixProof of concept: Reference safety verifier bypass

Module oracle.move

Function: get_price

This function can be used by any caller to extract the price of a given asset pair. The price is returned as a tuple of three values: (u256, u64, u64). The first value is the price of the asset pair, the second value is the time stamp of the price, and the third value is the price's number of decimals.

Inputs

Full prototype: #[view] public fun get_price(pair_id: String): (u256, u64, u64)

  • pair_id: String

    • Validation: Must be a oracle stored in NativeOracleContract's prices map.

    • Impact: Specifies which asset pair's price to get.

Zellic © 2025Back to top ↑