Vulnerability: Price can be miscalculated.
Severity: medium

Description:
In `SimplePriceFeedStrategy.sol#getMedianPrice` function, when the length of `nonZeroPrices` is 2 and they are deviated it returns first non-zero value, not median value.\\n`SimplePriceFeedStrategy.sol#getMedianPriceIfDeviation` is as follows.\\n```\\n    function getMedianPriceIfDeviation(\\n        uint256[] memory prices_,\\n        bytes memory params_\\n    ) public pure returns (uint256) {\\n        // Misconfiguration\\n        if (prices_.length < 3) revert SimpleStrategy_PriceCountInvalid(prices_.length, 3);\\n\\n237     uint256[] memory nonZeroPrices = _getNonZeroArray(prices_);\\n\\n        // Return 0 if all prices are 0\\n        if (nonZeroPrices.length == 0) return 0;\\n\\n        // Cache first non-zero price since the array is sorted in place\\n        uint256 firstNonZeroPrice = nonZeroPrices[0];\\n\\n        // If there are not enough non-zero prices to calculate a median, return the first non-zero price\\n246     if (nonZeroPrices.length < 3) return firstNonZeroPrice;\\n\\n        uint256[] memory sortedPrices = nonZeroPrices.sort();\\n\\n        // Get the average and median and abort if there's a problem\\n        // The following two values are guaranteed to not be 0 since sortedPrices only contains non-zero values and has a length of 3+\\n        uint256 averagePrice = _getAveragePrice(sortedPrices);\\n253     uint256 medianPrice = _getMedianPrice(sortedPrices);\\n\\n        if (params_.length != DEVIATION_PARAMS_LENGTH) revert SimpleStrategy_ParamsInvalid(params_);\\n        uint256 deviationBps = abi.decode(params_, (uint256));\\n        if (deviationBps <= DEVIATION_MIN || deviationBps >= DEVIATION_MAX)\\n            revert SimpleStrategy_ParamsInvalid(params_);\\n\\n        // Check the deviation of the minimum from the average\\n        uint256 minPrice = sortedPrices[0];\\n262     if (((averagePrice - minPrice) * 10000) / averagePrice > deviationBps) return medianPrice;\\n\\n        // Check the deviation of the maximum from the average\\n        uint256 maxPrice = sortedPrices[sortedPrices.length - 1];\\n266     if (((maxPrice - averagePrice) * 10000) / averagePrice > deviationBps) return medianPrice;\\n\\n        // Otherwise, return the first non-zero value\\n        return firstNonZeroPrice;\\n    }\\n```\\n\\nAs you can see above, on L237 it gets the list of non-zero prices. If the length of this list is smaller than 3, it assumes that a median price cannot be calculated and returns first non-zero price. This is wrong. If the number of non-zero prices is 2 and they are deviated, it has to return median value. The `_getMedianPrice` function called on L253 is as follows.\\n```\\n    function _getMedianPrice(uint256[] memory prices_) internal pure returns (uint256) {\\n        uint256 pricesLen = prices_.length;\\n\\n        // If there are an even number of prices, return the average of the two middle prices\\n        if (pricesLen % 2 == 0) {\\n            uint256 middlePrice1 = prices_[pricesLen / 2 - 1];\\n            uint256 middlePrice2 = prices_[pricesLen / 2];\\n            return (middlePrice1 + middlePrice2) / 2;\\n        }\\n\\n        // Otherwise return the median price\\n        // Don't need to subtract 1 from pricesLen to get midpoint index\\n        // since integer division will round down\\n        return prices_[pricesLen / 2];\\n    }\\n```\\n\\nAs you can see, the median value can be calculated from two values. This problem exists at `getMedianPrice` function as well.\\n```\\n    function getMedianPrice(uint256[] memory prices_, bytes memory) public pure returns (uint256) {\\n        // Misconfiguration\\n        if (prices_.length < 3) revert SimpleStrategy_PriceCountInvalid(prices_.length, 3);\\n\\n        uint256[] memory nonZeroPrices = _getNonZeroArray(prices_);\\n\\n        uint256 nonZeroPricesLen = nonZeroPrices.length;\\n        // Can only calculate a median if there are 3+ non-zero prices\\n        if (nonZeroPricesLen == 0) return 0;\\n        if (nonZeroPricesLen < 3) return nonZeroPrices[0];\\n\\n        // Sort the prices\\n        uint256[] memory sortedPrices = nonZeroPrices.sort();\\n\\n        return _getMedianPrice(sortedPrices);\\n    }\\n```\\n

Impact:
When the length of `nonZeroPrices` is 2 and they are deviated, it returns first non-zero value, not median value. It causes wrong calculation error.

Recommended mitigation:
First, `SimplePriceFeedStrategy.sol#getMedianPriceIfDeviation` function has to be rewritten as follows.\\n```\\n    function getMedianPriceIfDeviation(\\n        uint256[] memory prices_,\\n        bytes memory params_\\n    ) public pure returns (uint256) {\\n        // Misconfiguration\\n        if (prices_.length < 3) revert SimpleStrategy_PriceCountInvalid(prices_.length, 3);\\n\\n        uint256[] memory nonZeroPrices = _getNonZeroArray(prices_);\\n\\n        // Return 0 if all prices are 0\\n        if (nonZeroPrices.length == 0) return 0;\\n\\n        // Cache first non-zero price since the array is sorted in place\\n        uint256 firstNonZeroPrice = nonZeroPrices[0];\\n\\n        // If there are not enough non-zero prices to calculate a median, return the first non-zero price\\n-       if (nonZeroPrices.length < 3) return firstNonZeroPrice;\\n+       if (nonZeroPrices.length < 2) return firstNonZeroPrice;\\n\\n        // rest of code\\n    }\\n```\\n\\nSecond, `SimplePriceFeedStrategy.sol#getMedianPrice` has to be modified as following.\\n```\\n    function getMedianPrice(uint256[] memory prices_, bytes memory) public pure returns (uint256) {\\n        // Misconfiguration\\n        if (prices_.length < 3) revert SimpleStrategy_PriceCountInvalid(prices_.length, 3);\\n\\n        uint256[] memory nonZeroPrices = _getNonZeroArray(prices_);\\n\\n        uint256 nonZeroPricesLen = nonZeroPrices.length;\\n        // Can only calculate a median if there are 3+ non-zero prices\\n        if (nonZeroPricesLen == 0) return 0;\\n-       if (nonZeroPricesLen < 3) return nonZeroPrices[0];\\n+       if (nonZeroPricesLen < 2) return nonZeroPrices[0];\\n\\n        // Sort the prices\\n        uint256[] memory sortedPrices = nonZeroPrices.sort();\\n\\n        return _getMedianPrice(sortedPrices);\\n    }\\n```\\n