Summary

No check for round completeness could lead to stale prices and wrong price return value, or outdated price. The functions rely on accurate price feed might not work as expected, sometimes can lead to fund loss.

Vulnerability Details

The oracle wrapper getOraclePrice() call out to an oracle with latestRoundData() to get the price of some token. Although the returned timestamp is checked, there is no check for round completeness.

Impact

This could lead to stale prices and wrong price return value, or outdated price.

As a result, the functions rely on accurate price feed might not work as expected, sometimes can lead to fund loss. The impacts vary and depends on the specific situation like the following:

incorrect liquidation
some users could be liquidated when they should not
no liquidation is performed when there should be
wrong price feed
causing inappropriate loan being taken, beyond the current collateral factor

Tools Used

Manual Review

Recommendations

require(answeredInRound >= roundID, "round not complete");