[M-03] updatedAt can be zero
Summary
The updatedAt variable is the timestamp at which the price was last updated. If updatedAt is equal to zero, it usually means that the data from the last round has not yet been updated or that the price oracle has not provided it yet. no data.
Vulnerability Details
Because it is allowed to use any Chainlink data feed, if the selected pair has just been implemented and has not provided any data yet. Until the first price is published, updatedAt will be zero.
Or it could also have resulted from a bug or problem with the price oracle that is preventing it from updating.
Providing a stale price that impacts the DSCEngine
Impact
High
Tools Used
Manual code review
Recommendations
Add a statement that guarantees that updateAt is greater than zero.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.