From fddc674742485a1d58fd42302da8a76be1e6bb9a Mon Sep 17 00:00:00 2001
From: "A.L." <xenide@users.noreply.github.com>
Date: Fri, 9 Aug 2024 00:24:13 +0200
Subject: [PATCH] fix: introduce limits for threshold

---
 src/ReservoirPriceOracle.sol         |  2 +-
 src/libraries/RoutesLib.sol          |  2 +-
 test/unit/ReservoirPriceOracle.t.sol | 20 ++++++++++++++++++++
 3 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/src/ReservoirPriceOracle.sol b/src/ReservoirPriceOracle.sol
index b87831d..adfcd59 100644
--- a/src/ReservoirPriceOracle.sol
+++ b/src/ReservoirPriceOracle.sol
@@ -29,7 +29,7 @@ contract ReservoirPriceOracle is IPriceOracle, Owned(msg.sender), ReentrancyGuar
 
     event DesignatePair(address token0, address token1, ReservoirPair pair);
     event FallbackOracleSet(address fallbackOracle);
-    event PriceUpdateRewardThreshold(address token0, address token1, uint16 threshold);
+    event PriceUpdateRewardThreshold(address token0, address token1, uint256 threshold);
     event RewardGasAmount(uint256 newAmount);
     event Route(address token0, address token1, address[] route);
     event TwapPeriod(uint256 newPeriod);
diff --git a/src/libraries/RoutesLib.sol b/src/libraries/RoutesLib.sol
index fd6b614..294b561 100644
--- a/src/libraries/RoutesLib.sol
+++ b/src/libraries/RoutesLib.sol
@@ -30,7 +30,7 @@ library RoutesLib {
     // Assumes that aDecimalDifference is between -18 and 18
     // Assumes that aPrice is between 1 and 1e36
     // Assumes that aRewardThreshold is <= Constants.BP_SCALE
-    function packSimplePrice(int256 aDecimalDifference, uint256 aPrice, uint16 aRewardThreshold)
+    function packSimplePrice(int256 aDecimalDifference, uint256 aPrice, uint256 aRewardThreshold)
         internal
         pure
         returns (bytes32 rPacked)
diff --git a/test/unit/ReservoirPriceOracle.t.sol b/test/unit/ReservoirPriceOracle.t.sol
index 39ac0dc..3d6ed42 100644
--- a/test/unit/ReservoirPriceOracle.t.sol
+++ b/test/unit/ReservoirPriceOracle.t.sol
@@ -268,6 +268,7 @@ contract ReservoirPriceOracleTest is BaseTest {
 
         address[] memory lRoute = new address[](2);
         uint16[] memory lRewardThreshold = new uint16[](1);
+        lRewardThreshold[0] = Constants.BP_SCALE;
         (lRoute[0], lRoute[1]) =
             lTokenA < lTokenB ? (address(lTokenA), address(lTokenB)) : (address(lTokenB), address(lTokenA));
         _oracle.setRoute(lRoute[0], lRoute[1], lRoute, lRewardThreshold);
@@ -329,6 +330,7 @@ contract ReservoirPriceOracleTest is BaseTest {
             lRoute[1] = address(lTokenB);
 
             uint16[] memory lRewardThreshold = new uint16[](2);
+            lRewardThreshold[0] = lRewardThreshold[1] = Constants.BP_SCALE;
             _oracle.setRoute(lRoute[0], lRoute[2], lRoute, lRewardThreshold);
             _writePriceCache(
                 address(lTokenA) < address(lTokenB) ? address(lTokenA) : address(lTokenB),
@@ -341,6 +343,7 @@ contract ReservoirPriceOracleTest is BaseTest {
                 lPrice2
             );
         }
+
         // act
         uint256 lAmtCOut = _oracle.getQuote(lAmtIn * 10 ** lTokenADecimal, address(lTokenA), address(lTokenC));
 
@@ -1024,6 +1027,23 @@ contract ReservoirPriceOracleTest is BaseTest {
         _oracle.setRoute(lToken0, lToken1, lInvalidRoute2, lRewardThreshold);
     }
 
+    function testSetRoute_InvalidRewardThreshold() external {
+        // arrange
+        address[] memory lRoute = new address[](2);
+        uint16[] memory lInvalidRewardThreshold = new uint16[](1);
+        lInvalidRewardThreshold[0] = Constants.BP_SCALE + 1;
+        lRoute[0] = address(_tokenC);
+        lRoute[1] = address(_tokenD);
+
+        // act & assert
+        vm.expectRevert(OracleErrors.InvalidRewardThreshold.selector);
+        _oracle.setRoute(lRoute[0], lRoute[1], lRoute, lInvalidRewardThreshold);
+
+        lInvalidRewardThreshold[0] = 0;
+        vm.expectRevert(OracleErrors.InvalidRewardThreshold.selector);
+        _oracle.setRoute(lRoute[0], lRoute[1], lRoute, lInvalidRewardThreshold);
+    }
+
     function testUpdateRewardGasAmount_NotOwner() external {
         // act & assert
         vm.prank(address(123));