Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

In OracleLib.sol, Chainlink's latestRoundData might return stale or incorrect results

0xrizwan

Summary

Chainlink's latestRoundData might return stale or incorrect results

Vulnerability Details

Impact

The staleCheckLatestRoundData() function in the OracleLib.sol fetches the asset price from a Chainlink aggregator V3 using the latestRoundData function as used at L-27.

File: src/libraries/OracleLib.sol
​
21 function staleCheckLatestRoundData(AggregatorV3Interface priceFeed)
22 public
23 view
24 returns (uint80, int256, uint256, uint256, uint80)
25 {
26 (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
27 priceFeed.latestRoundData();
28
29 uint256 secondsSince = block.timestamp - updatedAt;
30 if (secondsSince > TIMEOUT) revert OracleLib__StalePrice();
31
32 return (roundId, answer, startedAt, updatedAt, answeredInRound);
33 }

However, there are no checks on roundID, resulting in stale prices. The oracle wrapper calls out to a chainlink oracle receiving the latestRoundData().

Stale prices could put funds at risk. According to Chainlink's documentation, This function does not error if no answer has been reached but returns 0, causing an incorrect price fed to the PriceOracle. The external Chainlink oracle, which provides index price information to the system, introduces risk inherent to any dependency on third-party data sources. For example, the oracle could fall behind or otherwise fail to be maintained, resulting in outdated data being fed to the index price calculations. Oracle reliance has historically resulted in crippled on-chain systems, and complications that lead to these outcomes can arise from things as simple as network congestion.

Chainlink latestRoundData ref

Chainlink reference-
https://docs.chain.link/data-feeds/historical-data#getrounddata-return-values

Tools Used

Manual Review

Recommendations

Consider adding missing checks for stale data.

File: src/libraries/OracleLib.sol
​
function staleCheckLatestRoundData(AggregatorV3Interface priceFeed)
public
view
returns (uint80, int256, uint256, uint256, uint80)
{
(uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
priceFeed.latestRoundData();
+ require(answer > 0, "Chainlink price <= 0");
+ require(answeredInRound >= roundID, "Stale price");
+ require(startedAt != 0, "Round not complete");
​
uint256 secondsSince = block.timestamp - updatedAt;
if (secondsSince > TIMEOUT) revert OracleLib__StalePrice();
​
return (roundId, answer, startedAt, updatedAt, answeredInRound);
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.