fix: 🛠️ Sherlock audit remediation

README.md

@@ -74,6 +74,7 @@ All configuration options can be set via CLI arguments, environment variables, o
 | `--ignore-timeout-check/--enforce-timeout-check` | `TQ_ORACLE_IGNORE_TIMEOUT_CHECK` | `ignore_timeout_check` | `false` | Skip minimum interval guard between reports |
 | `--ignore-active-proposal-check/--enforce-active-proposal-check` | `TQ_ORACLE_IGNORE_ACTIVE_PROPOSAL_CHECK` | `ignore_active_proposal_check` | `false` | Skip duplicate active proposal guard |
 | `--log-level` | `TQ_ORACLE_LOG_LEVEL` | `log_level` | `"INFO"` | Override logging verbosity (`TRACE`, `DEBUG`, `INFO`, `WARNING`, `ERROR`, `CRITICAL`) |
+| `--global-timeout-seconds` | `TQ_ORACLE_GLOBAL_TIMEOUT_SECONDS` | `global_timeout_seconds` | `600.0` | Maximum seconds allowed for the full pipeline (set `0` to disable) |
 | `--show-config` | - | - | `false` | Dump effective configuration (with secrets redacted) and exit |
 
 #### TOML-Only Options (Not available via CLI)

pyproject.toml

@@ -22,6 +22,7 @@ dev = [
     "pytest>=8.4.2",
     "pytest-asyncio>=1.2.0",
     "pytest-env>=1.1.0",
+    "pytest-mock>=3.15.1",
     "ruff>=0.13.2",
 ]
 

src/tq_oracle/abi.py

@@ -6,6 +6,8 @@
 from eth_typing import URI, ChecksumAddress
 from web3 import Web3
 
+from tq_oracle.settings import OracleSettings
+
 ABIS_DIR = Path(__file__).parent / "abis"
 
 ORACLE_ABI_PATH = ABIS_DIR / "IOracle.json"
@@ -85,7 +87,7 @@ def load_stakewise_os_token_vault_escrow_abi() -> list[dict]:
     return load_abi(STAKEWISE_OS_TOKEN_VAULT_ESCROW_ABI_PATH)
 
 
-def get_oracle_address_from_vault(vault_address: str, rpc_url: str) -> ChecksumAddress:
+def get_oracle_address_from_vault(settings: OracleSettings) -> ChecksumAddress:
     """Fetch the oracle address from the vault contract.
 
     Args:
@@ -99,6 +101,9 @@ def get_oracle_address_from_vault(vault_address: str, rpc_url: str) -> ChecksumA
         ConnectionError: If RPC connection fails
         ValueError: If contract call fails
     """
+    rpc_url = settings.vault_rpc_required
+    vault_address = settings.vault_address_required
+    block_number = settings.block_number_required
     w3 = Web3(Web3.HTTPProvider(URI(rpc_url)))
     if not w3.is_connected():
         raise ConnectionError(f"Failed to connect to RPC: {rpc_url}")
@@ -108,7 +113,9 @@ def get_oracle_address_from_vault(vault_address: str, rpc_url: str) -> ChecksumA
     vault_contract = w3.eth.contract(address=checksum_vault, abi=vault_abi)
 
     try:
-        oracle_addr: ChecksumAddress = vault_contract.functions.oracle().call()
+        oracle_addr: ChecksumAddress = vault_contract.functions.oracle().call(
+            block_identifier=block_number
+        )
         return oracle_addr
     except Exception as e:
         raise ValueError(f"Failed to fetch oracle address from vault: {e}") from e

src/tq_oracle/adapters/asset_adapters/idle_balances.py

@@ -106,7 +106,9 @@ async def _rpc(self, fn, *args, **kwargs):
     def adapter_name(self) -> str:
         return "idle_balances"
 
-    async def fetch_assets(self, subvault_address: str) -> list[AssetData]:
+    async def fetch_assets(
+        self, subvault_address: str, *, supported_assets: list[str] | None = None
+    ) -> list[AssetData]:
         """Fetch idle balances for the given subvault on the configured chain.
 
         Args:
@@ -115,7 +117,8 @@ async def fetch_assets(self, subvault_address: str) -> list[AssetData]:
         Returns:
             List of AssetData objects containing asset addresses and balances
         """
-        supported_assets = await self._fetch_supported_assets()
+        if supported_assets is None:
+            supported_assets = await self._fetch_supported_assets()
 
         logger.debug(
             "Fetching L1 balances for subvault %s across %d assets",
@@ -161,9 +164,13 @@ async def fetch_all_assets(self) -> list[AssetData]:
             len(subvault_addresses),
             len(vault_addresses) - 1 - len(subvault_addresses),
         )
+        supported_assets = await self._fetch_supported_assets()
 
         asset_results = await asyncio.gather(
-            *[self.fetch_assets(addr) for addr in vault_addresses],
+            *[
+                self.fetch_assets(addr, supported_assets=supported_assets)
+                for addr in vault_addresses
+            ],
             return_exceptions=True,
         )
 
@@ -242,9 +249,7 @@ async def _fetch_subvault_addresses(self) -> list[str]:
     async def _fetch_supported_assets(self) -> list[str]:
         """Get the supported assets for the given vault."""
         oracle_abi = load_oracle_abi()
-        oracle_address = get_oracle_address_from_vault(
-            self.config.vault_address_required, self.config.vault_rpc_required
-        )
+        oracle_address = get_oracle_address_from_vault(self.config)
         raw_assets = await self._fetch_contract_list(
             contract_address=oracle_address,
             abi=oracle_abi,

src/tq_oracle/adapters/check_adapters/__init__.py

@@ -4,11 +4,9 @@
     ActiveSubmitReportProposalCheck,
 )
 
-from tq_oracle.adapters.check_adapters.safe_state import SafeStateAdapter
 from tq_oracle.adapters.check_adapters.timeout_check import TimeoutCheckAdapter
 
 CHECK_ADAPTERS = [
-    SafeStateAdapter,
     ActiveSubmitReportProposalCheck,
     TimeoutCheckAdapter,
 ]

src/tq_oracle/adapters/check_adapters/active_submit_report_proposal_check.py

@@ -103,7 +103,9 @@ async def _get_active_submit_report_proposals(self) -> list[object]:
         safe_checksum = Web3.to_checksum_address(self._config.safe_address)
 
         safe_api_url = f"{tx_service.base_url}/api/v1/safes/{safe_checksum}/"
-        safe_info_response = await asyncio.to_thread(requests.get, safe_api_url)
+        safe_info_response = await asyncio.to_thread(
+            requests.get, safe_api_url, timeout=10.0
+        )
         safe_info_response.raise_for_status()
         safe_info_data = safe_info_response.json()
         current_nonce = int(safe_info_data.get("nonce", 0))

src/tq_oracle/adapters/check_adapters/timeout_check.py

@@ -84,7 +84,7 @@ async def run_check(self) -> CheckResult:
             (
                 _price_d18,
                 last_report_timestamp,
-                _is_suspicious,
+                is_suspicious,
             ) = await oracle.functions.getReport(first_asset).call(
                 block_identifier=block_number
             )
@@ -106,12 +106,19 @@ async def run_check(self) -> CheckResult:
                 block_identifier=block_number
             )
 
-            latest_block = await w3.eth.get_block("latest")
-            current_timestamp = latest_block["timestamp"]
+            block_info = await w3.eth.get_block(block_number)
+            current_timestamp = block_info["timestamp"]
 
             next_valid_time = last_report_timestamp + timeout
             can_submit = current_timestamp >= next_valid_time
 
+            if is_suspicious:
+                return CheckResult(
+                    passed=True,
+                    message="Last report marked as suspicious, immediate replace allowed",
+                    retry_recommended=False,
+                )
+
             if can_submit:
                 return CheckResult(
                     passed=True,

src/tq_oracle/adapters/price_adapters/base.py

@@ -2,6 +2,8 @@
 
 from abc import ABC, abstractmethod
 from dataclasses import dataclass
+from dataclasses import field
+from decimal import Decimal
 
 from ...settings import OracleSettings
 
@@ -11,7 +13,8 @@ class PriceData:
     """Price data from a price adapter."""
 
     base_asset: str
-    prices: dict[str, int]  # asset_address -> price_wei (18 decimals)
+    prices: dict[str, Decimal]  # asset_address -> price (D18) per base unit
+    decimals: dict[str, int] = field(default_factory=dict)
 
 
 class BasePriceAdapter(ABC):