Summary

OracleLib.sol latestRoundData() is used but there is no check to validate if the return value contains fresh data. Proper checks should be applied to prevent the use of stale price data.

If the function getUsdValue does not properly verify and handle incorrect data related to the priceFeed, it could lead to incorrect results in functions that depend on it, such as getAccountCollateralValue, this, in turn, could affect the calculation of users' health factor and affect other critical functions, potentially put the project's funds at risk.

It is crucial that any function using external data, such as token prices obtained from oracles or third-party price feeds (such as Chainlink in this case), performs appropriate checks and error handling to ensure the accuracy and security of the calculations.

Vulnerability Detail

This could lead to stale prices according to the Chainlink documentation:
https://docs.chain.link/data-feeds/price-feeds/historical-data

This, in turn, could affect the calculation of users' health factor and affect other critical functions, potentially put the project's funds at risk.

Impact

• If the function getUsdValue does not properly verify and handle incorrect data related to the priceFeed, it could lead to incorrect results in functions that depend on it, such as getAccountCollateralValue, this, in turn, could affect the calculation of users’ health factor and affect other critical functions, potentially put the project’s funds at risk.

Code Snippet

https://github.com/Cyfrin/2023-07-foundry-defi-stablecoin/blob/d1c5501aa79320ca0aeaa73f47f0dbc88c7b77e2/src/DSCEngine.sol#L363C1-L363C1

Tool used

Manual Review

Recommendation

To ensure that the priceFeed is always correct, you can do that simply by adding some require statements in Oraclelib.sol.