# API3 oracle timestamp can be set to future timestamp and block API3 Oracle usage to make code revert in underflow

API3 oracle timestamps can be up to 1h in the future, causing block.timestamp - timestamp to underflow and revert, blocking all API3 price reads in INIT Capital.

- Payout: Contest reward
- Severity: medium
- Program: INIT Capital
- Credited: ladboy233
- Disclosed: 2024-01-16
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2023-12-initcapital-findings/issues/4
- Library page: https://bugbountylibrary.com/r/c4%3A2023-12-initcapital%3AM-11
- Tags: domain:web3 impact:dos kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:dos

**Target:** Api3OracleReader.getPrice_e36 price feed reader
**Root cause:** The staleness check `block.timestamp - timestamp <= maxStaleTime` assumes timestamp <= block.timestamp, but API3's onlyValidTimestamp allows timestamps up to 1 hour in the future, so the subtraction underflows and reverts.
**Steps:**
1. API3 relayer calls processBeaconUpdate with timestamp = block.timestamp + up to 3600s; onlyValidTimestamp permits it.
2. DataFeed timestamp stored in the future.
3. INIT's getPrice_e36 reads (price, timestamp) via readDataFeedWithId.
4. Evaluate `block.timestamp - timestamp` where timestamp > block.timestamp; Solidity 0.8 underflow reverts.
5. All API3 oracle reads revert until wall-clock catches up to the stored timestamp.
**How found:** Code review of Api3OracleReader staleness check combined with reading API3's DataFeedServer onlyValidTimestamp modifier, noticing the 1-hour future tolerance contradicts the unchecked subtraction assumption.
**Exploitation:** No attacker action needed; a normal relayer update with a slightly future timestamp bricks API3 price reads, causing DoS on any INIT function depending on getPrice_e36 until block.timestamp exceeds the stored timestamp.
**Insight:** When integrating an oracle, read the oracle's own timestamp-validation bounds; if it permits future timestamps, any `block.timestamp - ts` staleness check must guard against underflow rather than assume ts is in the past.