# Wrong decoding of verifierResponse in OstiumPriceUpKeep::performUpkeep() Low/Info · Three Sigma · RWA perpetuals DEX · 19th February, 2024 Finding 3S-OS-N16 of the Ostium security review. - Protocol: https://www.ostium.com/ - Report: /reports/ostium - Source: https://cdn.sanity.io/files/qoqld077/production/a95b9c69e0f65d1d6b0e649f0d62a362358ca8ce.pdf --- ### Description [OstiumPriceUpKeep::performUpkeep()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumPriceUpKeep.sol#L103) decodes the verifierResponse setting an expiresAt as [uint192](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumPriceUpKeep.sol#L138-L145), when it is in fact a uint32 in both [Basic](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/test/foundry/OstiumPriceUpKeep.t.sol#L30) and [Premium](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/test/foundry/OstiumPriceUpKeep.t.sol#L40) reports. This has no impact as the variables are encoded as uint256 with abi.encode(), but should be addressed. Note: [here](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTradesUpKeep.sol#L113-L119) too. ### Recommendation Instead of decoding each element separately, decode to a BasicReport or PremiumReport struct. ### Status Addressed in [#3717915](https://github.com/0xOstium/smart-contracts-threeSigma/pull/58/commits/371791528385b6712390a5a07224cb5220f33bb3). --- Related findings: - [`LenderCommitmentGroup_Smart` picks the wrong Uniswap price, allowing borrowing at a discount by swapping before withdrawing](https://0xsimao.com/findings/teller-finance-picks-uniswap-price-allowing): Teller Finance