# Oracle fees should be payed upfront to protect the protocol from failed performeUpkeep() calls Crit/High · Three Sigma · RWA perpetuals DEX · 19th February, 2024 Finding 3S-OS-M05 of the Ostium security review. - Protocol: https://www.ostium.com/ - Report: /reports/ostium - Source: https://cdn.sanity.io/files/qoqld077/production/a95b9c69e0f65d1d6b0e649f0d62a362358ca8ce.pdf --- ### Description At the moment oracle fees are payed after the trades have been finalized, either in [registerTrade()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTradingCallbacks.sol#L420), [openTradeMarketCallback()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTradingCallbacks.sol#L182) or [closeTradeMarketCallback()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTradingCallbacks.sol#L231). [There](https://github.com/0xOstium/smart-contracts-threeSigma/blob/1b70cffbac621d39e321c159e45c048b703add92/src/interfaces/IOstiumPairsStorage.sol#L21) are some edge cases in which the trade does not get finalized, but the automation/upkeep is still performed, so the protocol incurs these losses. For example, if there is not a trade in [openTradeMarketCallback()](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTradingCallbacks.sol#L140-L142), fees will not be charged (this may happen if the user cancels the pending market open order after the [timeout](https://github.com/0xOstium/smart-contracts-threeSigma/blob/audit-feedback/src/OstiumTrading.sol#L493), but chainlink triggers the upkeep after closing). ### Recommendation Make the user pay oracle fees when they open the trades. ### Status Acknowledged --- Related findings: - [Performance and management fees could round up to protect the protocol](https://0xsimao.com/findings/morpho-vault-v2-performance-fees-round-protect): Morpho Vault V2 - [Drained oracle fees from market by depositing and withdrawing immediately without triggering settlement fees](https://0xsimao.com/findings/perennial-v2-oracle-fees-triggering-settlement): Perennial V2