QA Report

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/AMM.sol#L354
https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/AMM.sol#L392
https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/AMM.sol#L656-L704

Vulnerability details

Impact

The getTwapPrice() is used by the settleFunding() function to calculate the premium and subsequently the new funding rate. The _calcTwap() function will use the latest reserve snapshot if this snapshot is earlier than the baseTimestamp. As a result, if there are no changes on the underlying positions within the AMM, then the _addReserveSnapshot() function will never be called to update the price data. Over time, if the AMM is not being actively used, the funding rate can end up being drastically different to what it should be.

Proof of Concept

Tools Used

Manual code review.

Recommended Mitigation Steps

Consider calling _addReserveSnapshot() in settleFunding() to ensure the most up to date price is being used before calculating premium.

[atvanguard]

If the AMM has seen a period of inactivity then timestamp < baseTimestamp and it will return the latest known price which is intended behavior.

[JasoonS]

A valid consideration from what I can tell.

[JeeberC4]

Since this issue was downgraded to a QA level, and the warden did not submit a separate QA report, we've renamed this one to "QA report" for consistency.
The original title, for the record, was AMM.getTwapPrice() Potentially Uses an Outdated Price