15,000 USDC
View results
Submission Details
Severity: medium
Valid

Unchecked return data `roundId` from Chainlink aggregators

Summary

Vulnerability Details

The latestRoundData function in the library OracleLib.sol fetches the asset price
from a Chainlink aggregator using the latestRoundData function.
However, there are no checks on roundId.

Stale prices could put funds at risk.
According to Chainlink's documentation, This function does not error
if no answer has been reached but returns 0,
causing an incorrect price fed to the PriceOracle.
The external Chainlink oracle, which provides index price information to the system,
introduces risk inherent to any dependency on third-party data sources.
For example, the oracle could fall behind or otherwise fail to be maintained,
resulting in outdated data being fed to the index price calculations of the liquidity.

There is 1 instance of this issue:

Impact

Tools Used

Recommendations

Consider checking the oracle responses answeredInRound and roundId values after calling out
to chainlinkOracle.latestRoundData() verifying that the result is within
an allowed margin of freshness.

For example:

(
uint80 roundId,
int256 price,
uint256 startedAt,
uint256 updatedAt,
uint80 answeredInRound
) = aggregator.latestRoundData();
if (answeredInRound < roundId){
revert("answer is being carried over");
}
if (startedAt == 0) {
revert("Round not complete");
}
if (price == 0) {
revert("answer reporting 0");
}
if (updatedAt < block.timestamp - maxDelayTime) {
revert("time err");
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.