# Asset.lotPrice only uses oracleTimeout to determine if the price is stale.

Asset.lotPrice uses a single oracleTimeout to judge price staleness, but multi-feed collaterals have shorter per-feed timeouts, so stale prices can be returned as valid.

- Payout: Contest reward
- Severity: medium
- Program: Reserve
- Credited: sces60107
- Disclosed: 2023-11-13
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-07-reserve-findings/issues/17
- Library page: https://bugbountylibrary.com/r/c4%3A2023-07-reserve%3AM-10
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** Asset.lotPrice / collateral price oracles (Solidity)
**Root cause:** lotPrice() falls back to saved prices based solely on the constructor-set oracleTimeout, but collaterals like NonFiatCollateral and CurveStableCollateral derive price from multiple feeds with different (or unused) timeouts, so a malfunctioning shorter-timeout feed is not detected.
**Steps:**
1. Read Asset.lotPrice: on tryPrice() revert, if `delta = block.timestamp - lastSave <= oracleTimeout` it returns savedLowPrice/savedHighPrice.
2. Note NonFiatCollateral.tryPrice uses `targetUnitChainlinkFeed.price(targetUnitOracleTimeout)` where targetUnitOracleTimeout < oracleTimeout.
3. Make targetUnitChainlinkFeed malfunction; tryPrice reverts.
4. With delta between targetUnitOracleTimeout and oracleTimeout, lotPrice returns stale saved price instead of decaying/zeroing.
5. Same for CurveStableCollateral where oracleTimeout is unused and PoolToken.tokenPrice uses per-token timeouts.
**How found:** Code reading of lotPrice's staleness branch, then tracing each collateral's tryPrice to compare the timeouts actually used against the single oracleTimeout assumed by lotPrice.
**Insight:** When a base contract caches a config value (timeout) for fallback logic, check every override's price path: derived collaterals may use different or multiple timeouts, making the base assumption wrong.