Submission Details
Severity:
Chainlink's latestRoundData may return incorrect result
Summary
staleCheckLatestRoundData isn't sufficiently validated
Vulnerability Details
The staleCheckLatestRoundData function in the contract OracleLib fetches the ETH price from a Chainlink aggregator using the latestRoundData function. But this function lacks some important checks
Impact
Price may be incorrect
Tools Used
Manual Review
Recommendations
Add following checks
require(answeredInRound >= roundID, "Chainlink Price Stale");
require(price > 0, "Chainlink Malfunction");
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
23664 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.