Summary

The protocol uses Chainlink latestRoundData() API to fetch the USD prices of the collateral. It makes sure that the data is not stale by maintaining a 3 hours heartbeat check, meaning that if the price is not updated every three hour or less, the whole protocol will stop working. However, some Aggregator Feed uses a 24 hour heartbeat gap, which means that for those feeds, the protocol will be unusable for 21 hours a day.

Vulnerability Details

The protocol uses Chainlink latestRoundData() and checks that the price returned is within 3 hours by using a heartbeat check.

This protocol intends to work with all the USD denominated pairs of Chainlink, and there are 69 of them just on the Ethereum Mainnet.

Reference: https://data.chain.link/ethereum/mainnet/crypto-usd

Most of the USD denominated pairs will update their price every hour, so using those feeds will most of the time not cause a revert due to stale price. However, some of the USD denominated pairs, such as BNT/USD, FXS/USD and AMPL/USD uses a heartbeat time of 24 hours or more. This means that their price feed will only update once a day. Since the staleness check makes sure that the price feed is updated every 3 hours, the whole protocol will be down for 21 hours, or rather down until the price is updated again.

As of writing, the AMPL/USD price feed was updated 20 hours ago with about 27 hours left for the next update, meaning that if the protocol actually used the AMPL/USD, the protocol will not be usable for about 47 hours every cycle. In other words, for every 3 hours that the protocol is usable, there are 47 hours of downtime in which the protocol is unusable.

Impact

Protocol will be unusable for 24 hours or more every 3 hours, depending on the frequency of the price update from different Price Feeds.

Tools Used

Manual Review

Recommendations

Since this is probably going to be open-source code, it is imperative to let the developers know about such issues and not use those tokens as collateral. Best if the protocol whitelist all the acceptable Chainlink Aggregator Feeds that are safe for use for every EVM chain.