Same Hard-coded timeout used for multiple price feeds can result in stale prices treated as fresh when price feeds have different heartbeats
Summary
The same Hard-coded timeout is used for multiple price feeds. This may result in stale prices being treated as fresh when different price feeds have different hearbeats.
Vulnerability Details
Although btc/usd & eth/usd have the same heartbeat, this project aims to allow others to setup their own collateral tokens. However this won't work correctly as OracleLib.TIMEOUT has one hard-coded timeout for all price feeds.
Impact
When using price feeds with different heartbeats, the hard-coded timeout value will result in stale prices being treated as fresh, leading to potential loss of value to users and to the protocol.
Tools Used
Manual
Recommendations
In DSCEngine.constructor() allow callers to pass in a timeout value for every price feed address & change OracleLib.staleCheckLatestRoundData() to use this price-feed specific timeout value for the staleness check.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.