Summary

Not check oracle price accuracy

Vulnerability Details

Stale prices could put funds at risk. According to Chainlink's documentation, This function does not error if no answer has been reached but returns 0, causing an incorrect price fed to the Price Oracle. The external Chainlink oracle, which provides index price information to the system, introduces risk inherent to any dependency on third-party data sources. For example, the oracle could fall behind or otherwise fail to be maintained, resulting in outdated data being fed to the index price calculations. Oracle reliance has historically resulted in crippled on-chain systems, and complications that lead to these outcomes can arise from things as simple as network congestion.

Impact

Oracle prices can be outdated and inaccurate, and oracle prices have update cycles and threshold intervals. You should check the accuracy of the relevant data rather than simply reading the return value.

Tools Used

Visual Studio Code

Recommendations

Check that the timestamp with the return price is within the acceptable threshold.

For example: