CYS3-03: DEX Quotes Are A Single Point Of Failure For Claim Settlement - #101
Merged
Merged
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
dB2510
requested changes
May 8, 2026
dB2510
approved these changes
May 9, 2026
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit fa0f51a. Configure here.
| ); | ||
|
|
||
| ClaimManager(payable(contracts.claimManagerProxy)).setPremiumManager(contracts.premiumManagerProxy); | ||
| ClaimManager(payable(contracts.claimManagerProxy)).initializeV2(external_.oraclePriceFeed, 300); |
There was a problem hiding this comment.
Deploy script hardcodes deviation tolerance, inconsistent with upgrade
Low Severity
The initializeV2 call in Deploy.s.sol hardcodes 300 for priceDeviationToleranceBps, while UpgradeClaimManager.s.sol reads it from the PRICE_DEVIATION_TOLERANCE_BPS environment variable with a default of 300. Fresh deployments cannot override this value without modifying the script, unlike the upgrade path which is properly configurable.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit fa0f51a. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
High Risk
High risk because it changes claim slashing math and swap minimum-output derivation, and introduces new upgradeable storage/initialization requirements for
ClaimManagerthat can break live claim settlement if misconfigured.Overview
Hardens claim settlement against manipulated or unavailable DEX quotes.
ClaimManagernow usesOraclePriceFeedfair value as the primary pricing anchor for cross-token slashing andamountOutMin, while requiring the DEXquoteSwapto be within a configurablepriceDeviationToleranceBps(otherwise claims revert).Adds
ClaimManagerV2 state (oraclePriceFeed,priceDeviationToleranceBps) withinitializeV2+ admin setters, updates deployment/upgrade scripts to supportupgradeToAndCallinitialization, and wiresinitializeV2duringDeploy.s.sol.Renames configuration and documentation throughout from
CHAINLINK_PRICE_FEED/IChainlinkPriceFeedtoORACLE_PRICE_FEED/IOraclePriceFeed, updates CI/fork scripts/tests accordingly, and removes the old Chainlink interface in favor of the new oracle interface (withgetUSDValue,getTokenAmount,hasPriceFeed).Reviewed by Cursor Bugbot for commit fa0f51a. Bugbot is set up for automated code reviews on this repo. Configure here.