fix(oracle): extend cross-validation to non-Pyth tokens in price-router - #344
Conversation
The dcccrypto#227 cross-validation block (tightened to 5% by dcccrypto#315) only ran inside `if (pythSource)`, gating whether a Pyth source got enriched. For any token without a Pyth feed — the common case for permissionless markets, per instructions.ts's own description of that market class — the top DEX source was pushed into allSources at its raw liquidity-derived confidence (up to 90) with no check against an independent Jupiter reference. A single high-liquidity-labeled pool (manipulable via flash loan, per the SECURITY NOTE in dex-oracle.ts) could win bestSource outright even when Jupiter's price disagreed by an arbitrary amount. Fix: when both a DEX source and a Jupiter source are present, compare their prices using the same MAX_ENRICHMENT_DEVIATION threshold already established for Pyth enrichment (5%, per dcccrypto#315). If they diverge beyond it, cap the DEX source's confidence to Jupiter's (40) so it can no longer outrank a disagreeing independent reference purely on self-reported liquidity. The source stays in allSources for transparency — only its ranking weight is reduced. This applies before the Pyth block and only touches .confidence, not .price, so it doesn't affect the existing Pyth-enrichment price computation. Hoisted MAX_ENRICHMENT_DEVIATION out of the Pyth block so both checks share one threshold — using a looser tolerance for the non-Pyth path would reopen the same manipulation gap dcccrypto#315 just closed. Added regression tests in test/price-router.test.ts: a non-Pyth token with a high-liquidity DEX price 10x off from Jupiter has its DEX confidence capped to 40 (was 90); a non-Pyth token where DEX and Jupiter agree (within 5%) keeps full DEX confidence (90) and still wins bestSource. Confirmed the divergence test fails against the prior code (capped value 40 expected, raw 90 received) and passes against this fix. Full suite: 853 passed | 31 skipped (882 -> 884, +2 new tests).
|
Warning Review limit reached
More reviews will be available in 23 minutes and 43 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
1 participant
Summary
The #227 cross-validation block (tightened to 5% by #315) only ran inside
if (pythSource), gating whether a Pyth source got enriched. For any token without a Pyth feed — the common case for permissionless markets — the top DEX source was pushed intoallSourcesat its raw liquidity-derived confidence (up to 90) with no check against an independent Jupiter reference. A single high-liquidity-labeled pool (manipulable via flash loan, per the SECURITY NOTE index-oracle.ts) could winbestSourceoutright even when Jupiter's price disagreed by an arbitrary amount.This is a distinct gap from #315: that fix tightened the threshold used when enriching a Pyth price. It did not touch the no-Pyth-feed path, which had (and, before this PR, still has) zero cross-validation at all.
Fix
When both a DEX source and a Jupiter source are present, compare their prices using the same
MAX_ENRICHMENT_DEVIATIONthreshold already established for Pyth enrichment (5%, per #315). If they diverge beyond it, cap the DEX source's confidence to Jupiter's (40) so it can no longer outrank a disagreeing independent reference purely on self-reported liquidity. The source stays inallSourcesfor transparency — only its ranking weight is reduced. This applies before the Pyth block and only touches.confidence, not.price, so it doesn't affect the existing Pyth-enrichment price computation.MAX_ENRICHMENT_DEVIATIONis hoisted out of the Pyth block so both checks share one threshold — using a looser tolerance for the non-Pyth path would reopen the same manipulation gap #315 just closed.Test plan
bestSource.