Price returned by Oracle is not verified
As per the example provided by Tellor on how to integrate the Tellor oracle into the system, it has shown the need to check that the price returned by the oracle is not zero.\\n```\\nfunction getTellorCurrentValue(bytes32 _queryId)\\n ..SNIP..\\n    // retrieve most recent 20+ minute old value for a queryId. the time buffer allows time for a bad value to be disputed\\n    (, bytes memory data, uint256 timestamp) = tellor.getDataBefore(_queryId, block.timestamp - 20 minutes);\\n    uint256 _value = abi.decode(data, (uint256));\\n    if (timestamp == 0 || _value == 0) return (false, _value, timestamp);\\n```\\n\\nThus, the value returned from the `getDataBefore` function should be verified to ensure that the price returned by the oracle is not zero. However, this was not implemented.\\n```\\nFile: TellorOracle.sol\\n    function getPriceInEth(address tokenToPrice) external returns (uint256) {\\n        TellorInfo memory tellorInfo = _getQueryInfo(tokenToPrice);\\n        uint256 timestamp = block.timestamp;\\n        // Giving time for Tellor network to dispute price\\n        (bytes memory value, uint256 timestampRetrieved) = getDataBefore(tellorInfo.queryId, timestamp - 30 minutes);\\n        uint256 tellorStoredTimeout = uint256(tellorInfo.pricingTimeout);\\n        uint256 tokenPricingTimeout = tellorStoredTimeout == 0 ? DEFAULT_PRICING_TIMEOUT : tellorStoredTimeout;\\n\\n        // Check that something was returned and freshness of price.\\n        if (timestampRetrieved == 0 || timestamp - timestampRetrieved > tokenPricingTimeout) {\\n            revert InvalidDataReturned();\\n        }\\n\\n        uint256 price = abi.decode(value, (uint256));\\n        return _denominationPricing(tellorInfo.denomination, price, tokenToPrice);\\n    }\\n```\\n
Update the affected function as follows.\\n```\\nfunction getPriceInEth(address tokenToPrice) external returns (uint256) {\\n    TellorInfo memory tellorInfo = _getQueryInfo(tokenToPrice);\\n    uint256 timestamp = block.timestamp;\\n    // Giving time for Tellor network to dispute price\\n    (bytes memory value, uint256 timestampRetrieved) = getDataBefore(tellorInfo.queryId, timestamp // Remove the line below\\n 30 minutes);\\n    uint256 tellorStoredTimeout = uint256(tellorInfo.pricingTimeout);\\n    uint256 tokenPricingTimeout = tellorStoredTimeout == 0 ? DEFAULT_PRICING_TIMEOUT : tellorStoredTimeout;\\n\\n    // Check that something was returned and freshness of price.\\n// Remove the line below\\n   if (timestampRetrieved == 0 || timestamp // Remove the line below\\n timestampRetrieved > tokenPricingTimeout) {\\n// Add the line below\\n if (timestampRetrieved == 0 || value == 0 || timestamp // Remove the line below\\n timestampRetrieved > tokenPricingTimeout) {\\n        revert InvalidDataReturned();\\n    }\\n\\n    uint256 price = abi.decode(value, (uint256));\\n    return _denominationPricing(tellorInfo.denomination, price, tokenToPrice);\\n}\\n```\\n
The protocol relies on the oracle to provide accurate pricing for many critical operations, such as determining the debt values of DV, calculators/stats used during the rebalancing process, NAV/shares of the LMPVault, and determining how much assets the users should receive during withdrawal.\\nIf an incorrect value of zero is returned from Tellor, affected assets within the protocol will be considered worthless.
```\\nfunction getTellorCurrentValue(bytes32 _queryId)\\n ..SNIP..\\n    // retrieve most recent 20+ minute old value for a queryId. the time buffer allows time for a bad value to be disputed\\n    (, bytes memory data, uint256 timestamp) = tellor.getDataBefore(_queryId, block.timestamp - 20 minutes);\\n    uint256 _value = abi.decode(data, (uint256));\\n    if (timestamp == 0 || _value == 0) return (false, _value, timestamp);\\n```\\n