Using the same `TIMEOUT` in `OracleLib` for multiple chainlink oracles does not protect from stale price
Summary
Different chainlink oracles have different intervals when they are updated (heartbeat). Using the same TIMEOUT variable for all oracles does not protect against stale price
Vulnerability Details
The chainlink oracle for ETH/USD has a heartbeat of 1 hour, the chainlink oracle for SOL/USD has a heartbeat of 24 hours . If both coins are accepted as collateral for DSC, there is no way to set the constant TIMEOUT to ensure that any of the oracles return a stale price.
Impact
No protection against stale prices if the heartbeat of the oracles of two tokens accepted as collateral are different.
Tools Used
Manual review
Recommendations
Every token should have its own timeout variable depending on the heartbeat of its chainlink oracle. This variable could be saved in a struct for each coin together with the price feed address and should be passed as an argument when calling staleCheckLatestRoundData.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.