Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Oracle feed is insufficiently validated

33audits

Oracle Feed Validation Improvement

Summary

The current Oracle feed lacks sufficient validation. It is essential to implement proper validation for the return values from the latestRoundData(); function. If the values are not correct, the system should revert the transaction.

Impact

Due to the absence of validation, the price data obtained from the Oracle can become stale, leading to incorrect return values.

Tools Used

The review process involved manual inspection and assessment.

Recommendations

To enhance the Oracle feed's reliability, it is crucial to incorporate validation mechanisms for the values returned by the latestRoundData(); function. The following validations should be considered:

  1. Positive Value Check: Ensure that the values for answer, answeredInRound, startedAt, and updatedAt are greater than zero.

  2. Cross-Validation: If possible, validate the returned values against data from alternative sources or historical data to detect any inconsistencies such as if(answeredInRound <= roundId ) revert InvalidRoundId();.

By implementing these recommendations, the Oracle feed will be more robust and dependable, reducing the risk of providing incorrect price data and transaction results.

library OracleLib {
error OracleLib__StalePrice();
​
uint256 private constant TIMEOUT = 3 hours; // 3 * 60 * 60 = 10800 seconds
​
function staleCheckLatestRoundData(AggregatorV3Interface priceFeed)
public
view
returns (uint80, int256, uint256, uint256, uint80)
{
(uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
priceFeed.latestRoundData();
if(answer <= 0) revert InvalidUpdatedAt();
if(startedAt <= 0) revert InvalidStart();
if(updatedAt <= 0) revert InvalidUpdatedAt();
uint256 secondsSince = block.timestamp - updatedAt;
if (secondsSince > TIMEOUT) revert OracleLib__StalePrice();
​
return (roundId, answer, startedAt, updatedAt, answeredInRound);
}
​
function getTimeout(AggregatorV3Interface /* chainlinkFeed */ ) public pure returns (uint256) {
return TIMEOUT;
}
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.