Summary

If we require the most up-to-date prices possible. The difference in minutes can be critical, so three hours is definitely too long a time frame. And it is superior to the Heartbeat proposed by the two selected pairs.

Vulnerability Details

In the OracleLib.sol library inside the staleCheckLatestRoundData() function we can see the condition

The selected pairs (BTC/USD & ETH/USD) have a Heartbeat Threshold value of 3600 seconds and a proposed TIMEOUT value of 10800 seconds.

That is, it is possible that our function returns a stale price.

Impact

High

Tools Used

Manual code review

Recommendations

Update the TIMEOUT value according to the Heartbeat Threshold value of the pairs, even lower, including the tolerance to guarantee having recent data.