Summary

Every chainlink oracle comes with its own heartbeat which denotes the maximum time gap between 2 price updates. Chainlink price feeds can go stale, so the stablecoin protocol has a staleness check but the threshold is set globally and doesn't account for different oracles.

Vulnerability Details

This protocol sets the staleness check threshold to 3 hours:

However, for some assets this can be too long or too short. For example ETH/USD oracle has a heartbeat of 1 hour, and stablecoin oracles usually have a heartbeat of 24 hours.

Impact

Liquidation may occur on stale prices harming the protocol and its users.

Tools Used

Manual review.

Recommendations

Create a mapping to store a timeout for each collateral asset. At the time of fetching price for an asset, use the associated timeout for staleness check.