fix(oracle-middleware): revert when the Pyth confidence is higher than the price (#918)

* fix(oracle-middleware): revert when the Pyth confidence is higher than the price

* style: remove unused import in test

* feat: revert on WusdnEth oracle

* docs: ticker

* perf: use solady abs()

* docs: add comment on unchecked operations

* docs: remove ticker name

Author: samooyo

src/OracleMiddleware/OracleMiddlewareWithPyth.sol

@@ -147,19 +147,19 @@ contract OracleMiddlewareWithPyth is CommonOracleMiddleware, IOracleMiddlewareWi
         view
         returns (PriceInfo memory price_)
     {
+        uint256 adjust = (pythPrice.conf * _confRatioBps) / BPS_DIVISOR;
+
+        if (adjust >= pythPrice.price) {
+            revert OracleMiddlewareConfValueTooHigh();
+        }
+
         if (dir == PriceAdjustment.Down) {
-            uint256 adjust = (pythPrice.conf * _confRatioBps) / BPS_DIVISOR;
-            if (adjust >= pythPrice.price) {
-                // avoid underflow or zero price due to confidence interval adjustment
-                price_.price = 1;
-            } else {
-                // strictly positive
-                unchecked {
-                    price_.price = pythPrice.price - adjust;
-                }
+            unchecked {
+                // adjust is always less than pythPrice.price so we can safely subtract it
+                price_.price = pythPrice.price - adjust;
             }
         } else if (dir == PriceAdjustment.Up) {
-            price_.price = pythPrice.price + ((pythPrice.conf * _confRatioBps) / BPS_DIVISOR);
+            price_.price = pythPrice.price + adjust;
         } else {
             price_.price = pythPrice.price;
         }

src/OracleMiddleware/WusdnToEthOracleMiddlewareWithDataStreams.sol

@@ -9,7 +9,7 @@ import { CommonOracleMiddleware, OracleMiddlewareWithDataStreams } from "./Oracl
 
 /**
  * @title Middleware Implementation For Short ETH Protocol
- * @notice This contract is used to get the "inverse" price in ETH/WUSDN denomination, so that it can be used for a
+ * @notice This contract is used to get the "inverse" price in number of ETH per WUSDN, so that it can be used for a
  * shorting version of the USDN protocol with WUSDN as the underlying asset.
  * @dev This version uses Pyth or Chainlink Data Streams for liquidations, and only Chainlink Data Streams for
  * validation actions.

src/OracleMiddleware/WusdnToEthOracleMiddlewareWithPyth.sol

@@ -1,6 +1,8 @@
 // SPDX-License-Identifier: BUSL-1.1
 pragma solidity 0.8.26;
 
+import { FixedPointMathLib } from "solady/src/utils/FixedPointMathLib.sol";
+
 import { IBaseOracleMiddleware } from "../interfaces/OracleMiddleware/IBaseOracleMiddleware.sol";
 import { PriceInfo } from "../interfaces/OracleMiddleware/IOracleMiddlewareTypes.sol";
 import { IUsdn } from "../interfaces/Usdn/IUsdn.sol";
@@ -9,7 +11,7 @@ import { CommonOracleMiddleware, OracleMiddlewareWithPyth } from "./OracleMiddle
 
 /**
  * @title Middleware Implementation For Short ETH Protocol
- * @notice This contract is used to get the "inverse" price in ETH/WUSDN denomination, so that it can be used for a
+ * @notice This contract is used to get the "inverse" price in number of ETH per WUSDN, so that it can be used for a
  * shorting version of the USDN protocol with WUSDN as the underlying asset.
  * @dev This version uses Pyth for low-latency prices used during validation actions and liquidations.
  */
@@ -93,12 +95,19 @@ contract WusdnToEthOracleMiddlewareWithPyth is OracleMiddlewareWithPyth {
         // invert the sign of the confidence interval if necessary
         if (adjustmentDelta != 0) {
             uint256 adjustedPrice;
-            if (adjustmentDelta >= int256(ethPrice.neutralPrice)) {
-                // avoid underflow or zero price due to confidence interval adjustment
-                adjustedPrice = 1;
+            if (FixedPointMathLib.abs(adjustmentDelta) >= ethPrice.neutralPrice) {
+                revert OracleMiddlewareConfValueTooHigh();
+            }
+
+            if (adjustmentDelta > 0) {
+                // adjustmentDelta is strictly smaller than neutralPrice so we can safely subtract it
+                unchecked {
+                    adjustedPrice = ethPrice.neutralPrice - uint256(adjustmentDelta);
+                }
             } else {
-                adjustedPrice = uint256(int256(ethPrice.neutralPrice) - adjustmentDelta);
+                adjustedPrice = ethPrice.neutralPrice + uint256(-adjustmentDelta);
             }
+
             return PriceInfo({
                 price: PRICE_NUMERATOR / (adjustedPrice * divisor),
                 neutralPrice: PRICE_NUMERATOR / (ethPrice.neutralPrice * divisor),

src/interfaces/OracleMiddleware/IOracleMiddlewareErrors.sol

@@ -42,6 +42,9 @@ interface IOracleMiddlewareErrors {
      */
     error OracleMiddlewarePythPositiveExponent(int32 expo);
 
+    /// @notice Indicates that the confidence value is higher than the price.
+    error OracleMiddlewareConfValueTooHigh();
+
     /// @notice Indicates that the confidence ratio is too high.
     error OracleMiddlewareConfRatioTooHigh();
 

test/unit/Middlewares/Oracle/PythOracle.t.sol

@@ -4,7 +4,6 @@ pragma solidity 0.8.26;
 import { MOCK_PYTH_DATA } from "../utils/Constants.sol";
 import { OracleMiddlewareBaseFixture } from "../utils/Fixtures.sol";
 
-import { PriceInfo } from "../../../../src/interfaces/OracleMiddleware/IOracleMiddlewareTypes.sol";
 import { IUsdnProtocolTypes as Types } from "../../../../src/interfaces/UsdnProtocol/IUsdnProtocolTypes.sol";
 
 /// @custom:feature The `PythOracle` specific functions
@@ -18,17 +17,18 @@ contract TestOracleMiddlewarePythOracle is OracleMiddlewareBaseFixture {
      * @custom:given The price of the asset is $10 and the confidence interval is $30.
      * @custom:when The `parseAndValidatePrice` function is called with an action that uses the lower bound of the conf
      * interval.
-     * @custom:then The price is adjusted to 1 wei to avoid being negative or zero.
+     * @custom:then The function reverts with the error {OracleMiddlewareConfValueTooHigh}.
      */
     function test_pythConfGreaterThanPrice() public {
+        uint256 validationCost = oracleMiddleware.validationCost(MOCK_PYTH_DATA, Types.ProtocolAction.ValidateDeposit);
+
         mockPyth.setPrice(10e8);
         mockPyth.setConf(30e8);
 
-        // ValidateDeposit adjusts down with conf
-        PriceInfo memory price = oracleMiddleware.parseAndValidatePrice{
-            value: oracleMiddleware.validationCost(MOCK_PYTH_DATA, Types.ProtocolAction.ValidateDeposit)
-        }("", uint128(block.timestamp), Types.ProtocolAction.ValidateDeposit, MOCK_PYTH_DATA);
-        assertEq(price.price, 1, "price should be 1");
+        vm.expectRevert(OracleMiddlewareConfValueTooHigh.selector);
+        oracleMiddleware.parseAndValidatePrice{ value: validationCost }(
+            "", uint128(block.timestamp), Types.ProtocolAction.ValidateDeposit, MOCK_PYTH_DATA
+        );
     }
 
     /**