# Price updating mechanism can break

Renzo's L2 CCIP receiver reverts on price-deviation/timestamp checks, so a failing message can block all subsequent L1→L2 price updates, DoSing the feed.

- Payout: Contest reward
- Severity: medium
- Program: Renzo
- Credited: Fassi\_Security
- Disclosed: 2024-06-07
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2024-04-renzo-findings/issues/519
- Library page: https://bugbountylibrary.com/r/c4%3A2024-04-renzo%3AM-04
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:medium tech:evm technique:source-review vuln:dos vuln:oracle-manipulation

**Target:** CCIP receiver / xRenzoDeposit price update on L2
**Root cause:** _ccipReceive calls _updatePrice which reverts on zero price, >10% deviation, or stale/future timestamps; CCIP does not gracefully handle receiver reverts, so a failing message can stall the sequenced lane.
**Steps:**
1. L1 sendPrice sends CCIP message with ezETH rate to L2 receiver via linkRouterClient.ccipSend
2. L2 _ccipReceive decodes price/timestamp and calls xRenzoDeposit.updatePrice
3. _updatePrice reverts if `_price == 0`, deviation > lastPrice/10, `_timestamp <= lastPriceTimestamp`, or `_timestamp > block.timestamp`
4. If message fails and enters manual execution past the 8h Smart Execution window, subsequent messages are blocked until the first succeeds
5. Repeated failing updates (e.g. >10% deviation) keep the lane DoS'ed; gas bumping cannot fix a logical revert
**How found:** Read Chainlink CCIP manual-execution docs on message sequencing and matched them against the receiver's unhandled revert paths in _updatePrice, noting honest usage alone can trigger them.
**Escalation:** If CCIP is the chosen price path, L2 price data becomes stale/corrupted and minting prices miscalculate until receiver redeploy or owner updatePriceByOwner.
**Insight:** When integrating CCIP/cross-chain messaging, enumerate every revert path in the receiver: any logical revert (deviation checks, timestamp guards) can stall a sequenced lane, not just gas issues—design receivers to never revert on delivery.