Summary

Different chainlink oracles have different intervals when they are updated (heartbeat). Using the same TIMEOUT variable for all oracles does not protect against stale price

Vulnerability Details

The chainlink oracle for ETH/USD has a heartbeat of 1 hour, the chainlink oracle for SOL/USD has a heartbeat of 24 hours . If both coins are accepted as collateral for DSC, there is no way to set the constant TIMEOUT to ensure that any of the oracles return a stale price.

Impact

No protection against stale prices if the heartbeat of the oracles of two tokens accepted as collateral are different.

Tools Used

Manual review

Recommendations

Every token should have its own timeout variable depending on the heartbeat of its chainlink oracle. This variable could be saved in a struct for each coin together with the price feed address and should be passed as an argument when calling staleCheckLatestRoundData.