fix(dia): enforce pauseTimeAfter >= maxAge (cross-epoch mispricing)

[hardyjosh]

HIGH-severity stale-price risk around corporate actions, reported by a
curator's dev. The share price multiplies a DIA equity price by the vault's
LIVE totalAssets/totalSupply ratio, and both must belong to the same
corporate-action epoch. When an action (e.g. a stock split) completes the
vault ratio rebalances atomically, but DIA keeps serving the pre-action equity
price until its next push — up to maxAge seconds. The post-window pause is the
only barrier between the two epochs.

Nothing enforced that the pause outlasts the staleness window. With
pauseTimeAfter < maxAge, once the pause lifts a pre-action DIA price is still
"fresh" (age < maxAge, so accepted) and gets paired with the already-rebalanced
post-action ratio. On a 2:1 split the share reads ~2x its true value → a
borrower can draw against phantom collateral → bad debt. The staleness check
bounds age, not epoch, so it does not close this.

Fix: enforce the invariant pauseTimeAfter >= maxAge at initialize
(PauseTimeAfterBelowMaxAge). This makes the oldest still-fresh push at
pause-lift no older than the action's effectiveTime, so only same-epoch
(post-action) prices are ever served. Documented in the config + contract
NatSpec and the README (with a margin recommendation — the exact boundary is
only safe if DIA never times a push at the precise effectiveTime instant).

• New PauseTimeAfterBelowMaxAge(pauseTimeAfter, maxAge) error + init guard.
• Tests: below-boundary reverts, exact-boundary accepted, and the previously
  "valid" pre-window-only config (pauseTimeAfter == 0) now correctly rejected
  as the vulnerable shape. Verified each fails without the guard.
• Fixed configs that violated the new invariant: the fork test
  (maxAge 3650 days / pauseTimeAfter 1h -> 6h/6h) — the exact fixture the
  reporter flagged — the E2E test (1h -> 2h post-window), and the deployer
  idempotence test (vary pauseTimeAfter, not maxAge).

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_016cakZwdXx1U2yczfFHwVV1

Summary by CodeRabbit

• New Features

  • Added configuration validation requiring pauseTimeAfter >= maxAge.
  • Updated DIA staleness handling so values exactly maxAge old are treated as stale.

• Documentation

  • Updated README guidance and the Integrator Quickstart example for the timing invariant.

• Tests

  • Expanded coverage for invalid configurations, timing boundaries, stale data, and pause handovers.
  • Adjusted end-to-end and fork test timing for deterministic results.

[hardyjosh]

• fix(dia): enforce pauseTimeAfter >= maxAge (cross-epoch mispricing) #280 : 2 dependent PRs (#279 , #284 ) 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

📝 Walkthrough

Walkthrough

The DIA vault oracle now rejects configurations where pauseTimeAfter is less than maxAge and treats DIA data exactly maxAge old as stale. Documentation, tests, deployment determinism checks, and integration timing fixtures were updated.

Changes

DIA oracle timing invariant

Layer / File(s)	Summary
Initialization and staleness boundary src/concrete/oracle/DIAVaultOracle.sol	Adds PauseTimeAfterBelowMaxAge, documents the timing invariant, enforces it during initialization, and changes the DIA staleness boundary to age >= maxAge.
Configuration and boundary tests test/src/concrete/oracle/DIAVaultOracle.t.sol, test/src/concrete/deploy/DIAVaultOracleBeaconSetDeployer.t.sol	Tests invalid and equal timing configurations, exact-boundary staleness, freshness inside the boundary, pause handover behavior, fuzzed timing cases, and distinct CREATE2 configurations.
Examples and integration timing fixtures README.md, test/src/e2e/DIAStackE2E.t.sol, test/src/fork/DIAVaultOracleForkBase.t.sol	Updates timing examples and comments, and seeds fresh DIA data for deterministic fork assertions.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Initializer
  participant DIAVaultOracle
  participant DIAOracle
  Initializer->>DIAVaultOracle: initialize(config)
  DIAVaultOracle-->>Initializer: Revert if pauseTimeAfter < maxAge
  DIAVaultOracle->>DIAOracle: Read DIA feed
  DIAVaultOracle-->>Initializer: Revert if age >= maxAge

Loading

Possibly related PRs

• ST0x-Technology/st0x.oracle#249: Directly modifies the DIA oracle staleness logic, timing invariant, and related tests.
• ST0x-Technology/st0x.oracle#251: Modifies the same oracle implementation and related tests with complementary storage and pause validation changes.

Suggested reviewers: juanirios

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely states the main fix: enforcing pauseTimeAfter >= maxAge to prevent cross-epoch mispricing.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dia-cross-epoch-pause-invariant

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/concrete/oracle/DIAVaultOracle.sol`:
- Around line 288-301: Prevent the equality boundary from being accepted in the
DIAVaultOracle configuration by requiring pauseTimeAfter to be strictly greater
than maxAge, then update the related NatSpec at
src/concrete/oracle/DIAVaultOracle.sol:153-167 to describe the strict guarantee.
At test/src/concrete/oracle/DIAVaultOracle.t.sol:145-180, reject equality and
cover the exact effectiveTime stale-price case; update README.md:61-73
consistently. Configure PAUSE_AFTER with a margin above MAX_AGE in
test/src/e2e/DIAStackE2E.t.sol:40-41 and
test/src/fork/DIAVaultOracleForkBase.t.sol:48-53.

In `@test/src/fork/DIAVaultOracleForkBase.t.sol`:
- Around line 48-53: Update the fork test configuration around MAX_AGE and
PAUSE_AFTER so it no longer relies on the live DIA COIN value being refreshed
within six hours at the latest fork block. Use a deterministic pinned block or
fixture, seed a mock feed, or explicitly handle stale-data reverts while
preserving the cross-epoch invariant and test coverage.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 430603eb-744d-4bff-b39b-5c81afe3f90a

📥 Commits

Reviewing files that changed from the base of the PR and between 229755d and 8a90a93.

📒 Files selected for processing (6)

• README.md
• src/concrete/oracle/DIAVaultOracle.sol
• test/src/concrete/deploy/DIAVaultOracleBeaconSetDeployer.t.sol
• test/src/concrete/oracle/DIAVaultOracle.t.sol
• test/src/e2e/DIAStackE2E.t.sol
• test/src/fork/DIAVaultOracleForkBase.t.sol

[coderabbitai]

🧹 Nitpick comments (1)

test/src/concrete/oracle/DIAVaultOracle.t.sol (1)

383-407: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Add an end-to-end equality-boundary test.

These tests validate initialization and staleness independently, but do not exercise the composed invariant: a pre-action DIA push timestamped at effectiveTime must not be served when the post-action pause expires at effectiveTime + maxAge. Add a test that drives MockCorporateActions through that boundary and expects stale-price rejection.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/src/concrete/oracle/DIAVaultOracle.t.sol` around lines 383 - 407, Add an
end-to-end equality-boundary test alongside
testLatestAnswerAtMaxAgeBoundaryIsStale and
testLatestAnswerJustInsideMaxAgeNotStale. Drive MockCorporateActions with a
pre-action DIA push timestamped at effectiveTime, advance or warp until the
post-action pause expires at effectiveTime + MAX_AGE, then call the oracle
pricing path and expect DIAPriceStale rejection, preserving the composed
cross-epoch invariant.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/src/concrete/oracle/DIAVaultOracle.t.sol`:
- Around line 383-407: Add an end-to-end equality-boundary test alongside
testLatestAnswerAtMaxAgeBoundaryIsStale and
testLatestAnswerJustInsideMaxAgeNotStale. Drive MockCorporateActions with a
pre-action DIA push timestamped at effectiveTime, advance or warp until the
post-action pause expires at effectiveTime + MAX_AGE, then call the oracle
pricing path and expect DIAPriceStale rejection, preserving the composed
cross-epoch invariant.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 053a30f2-2804-4d7a-8c1a-923887a4d835

📥 Commits

Reviewing files that changed from the base of the PR and between 8a90a93 and 5faf379.

📒 Files selected for processing (4)

• README.md
• src/concrete/oracle/DIAVaultOracle.sol
• test/src/concrete/oracle/DIAVaultOracle.t.sol
• test/src/fork/DIAVaultOracleForkBase.t.sol

🚧 Files skipped from review as they are similar to previous changes (1)

• README.md

[coderabbitai]

🧹 Nitpick comments (1)

test/src/concrete/oracle/DIAVaultOracle.t.sol (1)

515-525: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider a positive control inside the fuzz body.

The fuzz assertions only require a revert. A mutant that makes latestAnswer revert on every input passes this test. The concrete test at Lines 455-459 is the only positive control, and it pins one config. Add a post-action push at the same instant when the read is not paused, then assert the oracle serves it.

♻️ Optional strengthening of the fuzz assertions

     bytes4 reason = bytes4(ret);
     assertTrue(
         reason == OraclePausedCorporateAction.selector || reason == DIAPriceStale.selector,
         "must revert paused or stale, not incidentally"
     );
+
+    // Positive control: once the pause lifts, a strictly post-action push at
+    // the same instant must be served, so a mutant that reverts on every
+    // input cannot satisfy this test.
+    if (reason == DIAPriceStale.selector) {
+        diaOracle.setValue(SYMBOL, 50e18, uint128(block.timestamp));
+        assertEq(oracle.latestAnswer(), int256(50e8), "post-action push must price once unpaused");
+    }

As per coding guidelines "Run forge test to execute all unit and fuzz tests".

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/src/concrete/oracle/DIAVaultOracle.t.sol` around lines 515 - 525,
Strengthen the fuzz test around DIAVaultOracle.latestAnswer by adding a
post-action DIA price push at the same effective post-action instant when the
oracle is not paused, then call latestAnswer and assert it successfully serves
the newly pushed value. Keep the existing pre-action rejection and
reason-selector assertions, and ensure the positive control proves the oracle is
not simply reverting for every input.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@test/src/concrete/oracle/DIAVaultOracle.t.sol`:
- Around line 515-525: Strengthen the fuzz test around
DIAVaultOracle.latestAnswer by adding a post-action DIA price push at the same
effective post-action instant when the oracle is not paused, then call
latestAnswer and assert it successfully serves the newly pushed value. Keep the
existing pre-action rejection and reason-selector assertions, and ensure the
positive control proves the oracle is not simply reverting for every input.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: e8508489-998c-4b3a-9044-03b7749e59fa

📥 Commits

Reviewing files that changed from the base of the PR and between 5faf379 and ffe1e03.

📒 Files selected for processing (1)

• test/src/concrete/oracle/DIAVaultOracle.t.sol