ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider

Summary A token lifecycle validation vulnerability was discovered in ZITADEL's external JWT Identity Provider IdP implementation. ZITADEL enforces a 1-hour maximum token age freshness window maxAge calculated from the token's issue time. However, this safety check is guarded by a presence...

TradingLibrary#verifyPrice doesn't check if data is fresh which can lead to costly downtime

Lines of code Vulnerability details Impact verifyPrice may check against stale data causing valid transactions to revert Proof of Concept if chainlinkEnabled && chainlinkFeed != address0 int256 assetChainlinkPriceInt = IPricechainlinkFeed.latestAnswer; if assetChainlinkPriceInt != 0 uint256...

Price Feed is not checked for freshness and may report old / incorrect value

Lines of code Vulnerability details Price Feed is not checked for freshness In times of network conjestion, the priceFeed may take longer than expected to update, and the price may take longer than usual to update, in order to ensure the latest price is fresh within update window, you should veri...