Skip to content

Findings by Yash#5

Draft
iamyxsh wants to merge 5 commits intomasterfrom
ys-findings
Draft

Findings by Yash#5
iamyxsh wants to merge 5 commits intomasterfrom
ys-findings

Conversation

@iamyxsh
Copy link
Copy Markdown

@iamyxsh iamyxsh commented Apr 8, 2026

No description provided.

XcmTransactor(handler).transact(oracle, input);
}

/// @notice Fixed oracle update handler that uses the payload-embedded price
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

by design .. if u use payload timestamp u effectively using oracle update timestamp than can be even day old .. StalePriceUpdate check is there is prevent processing old vaas (older than 5 minutes)


/// @notice Reset a processed VAA flag to allow replay
/// @dev EMERGENCY USE ONLY: Use when XCM execution failed on Hydration after VAA was marked processed
/// @dev VULNERABLE: After reset, anyone can call completeTransfer(vaa) to replay.
Copy link
Copy Markdown
Member

@nohaapav nohaapav Apr 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

by design .. anyone can call, front-running has no effect here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants