Assessment reports>Pyth2Wormhole>Discussion>latestPriceInfo does not check if price ID exists

latestPriceInfo does not check if price ID exists

latestPriceInfo (from PythGetters.sol) does not check whether the price ID exists in the _state.latestPriceInfo map and therefore returns a zero-initialized struct if the key does not exist.

There are two usages of latestPriceInfo (both in Pyth.sol):

  • One usage in queryPriceFeed, where the return value is explicitly checked to ensure the price ID was valid

  • One usage in updatePriceBatchFromVm, where no check is performed

It's unclear whether this edge case of latestPriceInfo was considered when writing updatePriceBatchFromVm.

function updatePriceBatchFromVm(bytes memory encodedVm) public returns (PythInternalStructs.BatchPriceAttestation memory bpa) {
    // [shortened for brevity...]
    PythInternalStructs.BatchPriceAttestation memory batch = parseBatchPriceAttestation(vm.payload);

    for (uint i = 0; i < batch.attestations.length; i++) {
        PythInternalStructs.PriceAttestation memory attestation = batch.attestations[i];
        PythInternalStructs.PriceInfo memory latestPrice = latestPriceInfo(attestation.priceId);

        if(attestation.timestamp > latestPrice.attestationTime) {
            setLatestPriceInfo(attestation.priceId, newPriceInfo(attestation));
        }
    }

    return batch;
}

If latestPrice is a zero-initialized struct, the attestationTime field has zero value, and the function still behaves correctly treating the attestation as new information to be added to the map.

We strongly suggest putting a notice in latestPriceInfo documentation, explaining the behaviour of the function and instructing the caller on how to check whether the given price ID existed in the map.

Alternatively, we encourage Pyth to consider implementing a safer getter, for instance returning a tuple (PriceInfo result, bool error). This significantly reduces the likelihood of a caller ignoring the possibility of the price ID not existing in the map due to the additional parameter.

Zellic © 2024Back to top ↑