# setSymbolsPrice() can use the priceSig from a long time ago

setSymbolsPrice only bounds priceSig.timestamp above, so a stale signed price with large negative upnl can be replayed to force OVERDUE liquidation harming partyB.

- Payout: Contest reward
- Severity: high
- Program: Symmetrical
- Credited: Ruhum
- Disclosed: 2023-06-05
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-06-symmetrical-judging/issues/113
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-06-symmetrical%3AH-1
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation vuln:signature-replay

**Target:** LiquidationFacetImpl.setSymbolsPrice / LibMuon.verifyPrices
**Root cause:** setSymbolsPrice enforces only an upper bound on priceSig.timestamp (liquidationTimestamp + timeout) and LibMuon.verifyPrices checks only the signature, not a lower time bound, so any old validly-signed priceSig is accepted.
**Steps:**
1. Observe setSymbolsPrice requires `priceSig.timestamp <= liquidationTimestamp[partyA] + liquidationTimeout` but no lower bound.
2. Obtain any previously signed PriceSig for partyA with a large negative upnl (e.g. from an earlier liquidation attempt or historical data).
3. Call the liquidation flow passing that stale priceSig; verifyPrices passes since signature is valid.
4. Contract computes upnl from stale data, triggering LiquidationType.OVERDUE against partyB.
**How found:** Code review of setSymbolsPrice noticed the require only caps timestamp above; tracing into LibMuon.verifyPrices confirmed no time-range check, revealing stale-signature replay.
**Exploitation:** Attacker replays an old validly-signed PriceSig with large negative upnl during liquidation of partyA, causing the protocol to settle partyB at an outdated unfavorable price and inflicting loss on partyB.
**Insight:** When a signed oracle/price payload is validated, check both bounds of its timestamp against the on-chain event time; a missing lower bound enables replay of stale signed data with attacker-favorable values.