[BUG]: Oracle with rewardBps above 1e5 can never accept a funded price submission

Open Beginner friendly
  • Is something wrong?
#27 1 comment 0 reactions 0 assignees View on GitHub

@kansalakshat is already working on this.

Since Nov 10, 2026.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
65/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
solidity
Domain
backend-api-design, blockchain

Research direction

Start with the constructor checks in src/Oracle.sol and the existing Foundry tests for reward configuration. Add coverage for a rewardBps above 1e5 and verify deployment rejects it; the issue provides a reproducer and the expected boundary. Done when the invalid value is rejected and a value of 1e5 still works.

Written by the indexing model from the issue text.

Description

bug
Bug Description

The Oracle constructor accepts any rewardBps. submitValue computes the reward pool as balance * REWARD_BPS / DENOMINATOR (src/Oracle.sol:129, DENOMINATOR = 1e5). If rewardBps is above 1e5 the pool is bigger than the contract balance, so the reward transfer fails and submitValue reverts with RewardTransferFailed().

REWARD_BPS is immutable, so once the oracle holds any ETH it can never take a price again. Anyone can put it in that state by sending 1 wei through receive() or deposit(). The frontend already limits the reward to 100% (= 1e5), but the factory and contract don't.

Steps to Reproduce
  1. Deploy an oracle with rewardBps = 200_000.
  2. Send it any ETH with deposit().
  3. Stake and wait out the deposit lock.
  4. Call submitValue. It reverts.
function test_rewardBpsAboveDenominator() public {
    Tok t = new Tok();
    Oracle o = new Oracle(address(this), "n", "d", address(t), 60, 50_000, 60, 60, 200_000, 0, 5);
    t.mint(alice, 100e18);
    vm.startPrank(alice);
    t.approve(address(o), 100e18);
    o.depositTokens(100e18);
    vm.stopPrank();
    o.deposit{value: 1 ether}();
    vm.warp(block.timestamp + 61);
    vm.prank(alice);
    o.submitValue(1e18);
}
Logs and Screenshots
[FAIL: RewardTransferFailed()] test_P2_rewardBpsUnbounded() (gas: 1368485)

With rewardBps = 100_000 the same test passes.

Environment Details

Windows 11, forge 1.8.4, solc 0.8.37 with via_ir, FOUNDRY_PROFILE=ci. Upstream main at 38a9803. Local test, no fork.

Proposed fix: if (rewardBps_ > DENOMINATOR) revert InvalidRewardBps(); in the constructor next to the InvalidSampleSize check, plus a test. I'd like to work on this, could you assign it to me?

Impact

Medium - Feature works but has issues

Dominant language
Solidity
Stars
3
Forks
3
Avg merge
15h 55m
Merged PRs (30d)
6

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from StabilityNexus/OrbOracle-Solidity

All issues in StabilityNexus/OrbOracle-Solidity

Similar issues

More Backend & API Design issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.