Skip to content

ERC20PriceOracleReceiptVault._nextId() swallows oracle revert, hiding cause behind divide-by-zero panic #299

Description

@thedavidmeister

ERC20PriceOracleReceiptVault._nextId() wraps priceOracle.price() in a bare try/catch and returns 0 on any revert. previewMint / mint then divide by zero in _calculateMint and surface as Panic(0x12), hiding the underlying cause (e.g. Pyth StalePrice()) from integrators, frontends, and on-chain monitoring.

No funds at risk: _deposit rejects shares==0/id==0 and _calculateMint panics before any transfer. The cost is purely diagnostic — a stale oracle is indistinguishable from a math bug.

Reproducer: cyclofinance/cyclo.sol#42 has a fork test pinning the StalePrice() (selector 0x19abf40e) → Panic(0x12) chain on Arbitrum at block 459580000 for cyWETH.PYTH. Suggested fix: rethrow on unknown selectors in the catch (or rethrow always — the ERC4626 "MUST NOT revert" requirement applies to view methods, not internal _nextId).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions