15,000 USDC
View results
Submission Details
Severity: medium
Valid

Oracle feed is insufficiently validated

Oracle Feed Validation Improvement

Summary

The current Oracle feed lacks sufficient validation. It is essential to implement proper validation for the return values from the latestRoundData(); function. If the values are not correct, the system should revert the transaction.

Impact

Due to the absence of validation, the price data obtained from the Oracle can become stale, leading to incorrect return values.

Tools Used

The review process involved manual inspection and assessment.

Recommendations

To enhance the Oracle feed's reliability, it is crucial to incorporate validation mechanisms for the values returned by the latestRoundData(); function. The following validations should be considered:

  1. Positive Value Check: Ensure that the values for answer, answeredInRound, startedAt, and updatedAt are greater than zero.

  2. Cross-Validation: If possible, validate the returned values against data from alternative sources or historical data to detect any inconsistencies such as if(answeredInRound <= roundId ) revert InvalidRoundId();.

By implementing these recommendations, the Oracle feed will be more robust and dependable, reducing the risk of providing incorrect price data and transaction results.

library OracleLib {
error OracleLib__StalePrice();
uint256 private constant TIMEOUT = 3 hours; // 3 * 60 * 60 = 10800 seconds
function staleCheckLatestRoundData(AggregatorV3Interface priceFeed)
public
view
returns (uint80, int256, uint256, uint256, uint80)
{
(uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
priceFeed.latestRoundData();
if(answer <= 0) revert InvalidUpdatedAt();
if(startedAt <= 0) revert InvalidStart();
if(updatedAt <= 0) revert InvalidUpdatedAt();
uint256 secondsSince = block.timestamp - updatedAt;
if (secondsSince > TIMEOUT) revert OracleLib__StalePrice();
return (roundId, answer, startedAt, updatedAt, answeredInRound);
}
function getTimeout(AggregatorV3Interface /* chainlinkFeed */ ) public pure returns (uint256) {
return TIMEOUT;
}
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.