Submitted by ronnyx2017
https://github.com/reserve-protocol/protocol/blob/9ee60f142f9f5c1fe8bc50eef915cf33124a534f/contracts/plugins/assets/curve/CurveStableRTokenMetapoolCollateral.sol#L46-L54
https://github.com/reserve-protocol/protocol/blob/9ee60f142f9f5c1fe8bc50eef915cf33124a534f/contracts/plugins/assets/curve/CurveStableCollateral.sol#L119-L121
https://github.com/reserve-protocol/protocol/blob/9ee60f142f9f5c1fe8bc50eef915cf33124a534f/contracts/plugins/assets/curve/CurveStableMetapoolCollateral.sol#L122-L138
The CurveStableMetapoolCollateral is intended for 2-fiattoken stable metapools that involve RTokens, such as eUSD-fraxBP. The metapoolToken coin0 is pairedToken, which is also a RToken, and the coin1 is lpToken, e.g. 3CRV. And the CurveStableRTokenMetapoolCollateral.tryPairedPrice uses RTokenAsset.price() as the oracle to get the pairedToken price:
Users cant redeem from RToken when any underlying collateral of paired RTokens price oracle is offline(timeout). It can lead to a serious run/depeg on the RToken.
First I submitted another issue named RTokenAsset price oracle can return a huge but valid high price when any underlying collaterals price oracle timeout. Its the premise for this issue. Because this issue is located in different collateral codes, I split them into two issues.
The conclusion from the pre issue:
Back to the CurveStableRTokenMetapoolCollateral. There are two cases that will revert in the super class CurveStableCollateral.refresh().
The CurveStableRTokenMetapoolCollateral.tryPairedPrice function gets low/high price from paired RTokenAsset.price(). So when any underlying collaterals price oracle of paired RTokenAsset reverts, the max high price will be FIX_MAX and the low price is non-zero.
And the CurveStableMetapoolCollateral overrides it:
So the uint192 mid = (low + high) / 2;  will revert because of uint192 overflow. The CurveStableRTokenMetapoolCollateral.refresh() will revert without any catch.
Because RToken.redeemTo and redeemCustom need to call assetRegistry.refresh(); at the beginning, it will revert directly.
The Fix.plus cant handle the uint192 overflow error. Try to override _anyDepeggedOutsidePool for CurveStableRTokenMetapoolCollateral as:
The assert assert(low <= high) in the RTokenAsset.tryPrice has already protected everything.
DoS
cccz (judge) decreased severity to Medium and commented:
pmckelvy1 (Reserve) confirmed
Reserve Mitigated:
Status: Mitigation confirmed. Full details in reports from ronnyx2017, RaymondFam and bin2chen .
