Hard-coded `TIMEOUT` not suitable for all Chainlink TOKEN/USD price feeds
Summary
Each TOKEN/USD's "heartbeat" ought to be the value for that pair's TIMEOUT.
Vulnerability Details
ETH/USD has a heartbeat of 3600 seconds and any data older than that should be considered stale. This heartbeat value varies for different pairs and should be fetched depending on the type of the token being used. The current hard-coded value of 3 hours is not suitable.
Impact
Stale price feed would result in protocol not able to recognize bad loans and hence major loss of funds.
Tools Used
Manual review
Recommendations
Fetch heartbeat of each token pair depending on the price feed address. The getTimeout() function already present there ought to be corrected.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.