# Excessive price staleness buffer allows usage of outdated oracle prices

PriceFeed adds a fixed 1-hour buffer to every oracle heartbeat, letting 30-minute-heartbeat prices be used up to 90 minutes stale, enabling inflated-collateral borrowing.

- Payout: Contest reward
- Severity: high
- Program: Bima
- Credited: 0xTheBlackPanther
- Disclosed: 2025-02-05
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_bima_december2024.pdf#3.1.1
- Library page: https://bugbountylibrary.com/r/cantina%3Abima_december2024%3A3.1.1
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:high tech:solidity technique:regression technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** PriceFeed.sol oracle staleness check (_isPriceStale)
**Root cause:** A constant RESPONSE_TIMEOUT_BUFFER of 1 hour is added to every oracle heartbeat regardless of its length, so short-heartbeat feeds tolerate prices up to 3x their intended max age.
**Steps:**
1. Set oracle with 30-minute heartbeat via `priceFeed.setOracle(stakedBTC, mockOracle2, 30 minutes, bytes4(0), 18, false)`.
2. Mock round 2 returns $2000 with updatedAt = block.timestamp.
3. `vm.warp(block.timestamp + 85 minutes)` and keep round 2 timestamp at now-85min.
4. `priceFeed.fetchPrice(stakedBTC)` still returns 2000e18 despite 85min > 30min heartbeat.
5. Warp +6 more minutes (91min total); fetchPrice reverts with `PriceFeed__FeedFrozenError`.
**How found:** Code review of _isPriceStale noticed the constant RESPONSE_TIMEOUT_BUFFER added to heartbeat; traced inheritance from Prisma and reasoned about short-heartbeat feeds.
**Exploitation:** Attacker watches for a sharp price drop while the oracle's old price remains within heartbeat+1h; mints loans against inflated collateral, then positions become undercollateralized once the oracle updates.
**Insight:** When auditing staleness checks, compare the buffer against the shortest configured heartbeat, not the default; a fixed buffer inherited from a fork can silently triple freshness tolerance for fast feeds.