Description
Summary
When validating vault report parameters in LazyOracle, the following line is used to get the inOutDelta value at the time of the last refSlot:
inOutDeltaOnRefSlot = vaultHub.inOutDeltaAsOfLastRefSlot(_vault);
However, there's an edge case:
If a report is created by the oracle for refSlot1, but the lazy report for the vault arrives after refSlot2 has started (and before the global report for refSlot2 has been submitted), then the lazy report will pass validation, but the inOutDeltaAsOfLastRefSlot method will return the value as of refSlot2, not refSlot1.
Expected Behavior
The inOutDelta used to validate a lazy report should always correspond to the refSlot the report is actually associated with.
Potential Impact
In the edge case described, this leads to incorrect inOutDelta computation at the time of the report and may result in an unintended quarantine trigger.
Steps to Reproduce
A test case demonstrating this issue will be available in the fix branch.
Possible Solutions
Implement a two-step inOutDelta cache that safely stores values for the two most recent refSlots, ensuring correct resolution based on the actual report context.
Guidelines
- I agree to follow Code of Conduct.
- I have read Lido Contribution Guide.