DittoETH

Summary

When querying the oracle price, for assets other than USD, there is no check for freshness of the price.

Vulnerability Details

In LibOracle.sol:getOraclePrice(), when asset is different than USD, oracleCircuitBreaker() is called to check the validity of both the asset/USD and ETH/USD prices. However, this function does not check the freshness of the prices, which can lead to the usage of stale prices.

From Chainlink documentation:

Your application should track the latestTimestamp variable or use the updatedAt value from the latestRoundData() function to make sure that the latest answer is recent enough for your application to use it. If your application detects that the reported answer is not updated within the heartbeat or within time limits that you determine are acceptable for your application, pause operation or switch to an alternate operation mode while identifying the cause of the delay.

Impact

The incorrect asset price can be used, which can lead to many problems, including users being required to deposit more/less collateral than expected or being liquidated when they shouldn't be.

Tools Used

Manual review.

Recommendations