Sysvar Cache Staleness Remediation
Overview
Related Detector: Sysvar Cache Staleness
Cached sysvar values can become stale during execution. The fix is to read sysvars close to the point of use rather than caching them early in execution.
Impact. A clock or rent value read at function entry and used after a CPI can reflect stale state, so a deadline, epoch, or timing check passes when it should fail. Any invariant that depends on current chain time is then enforced against the wrong value — for example a time-gated guard that lets an operation through after its expiry — which an attacker can steer by controlling execution timing.
Recommended Fix
// Read sysvar immediately before use
let clock = Clock::get()?;
require!(clock.unix_timestamp <= deadline, Expired);Common Mistakes
Mistake: Caching at Function Entry
// WRONG: cached at entry, used after CPI
let clock = Clock::get()?;
invoke(&external_ix, accounts)?;
// Clock value may not reflect current time accurately
require!(clock.unix_timestamp <= deadline, Expired);Re-read after CPI if timing is critical.