The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`LiquidationPool:distributeAssets()` Calls to chainlink price feed does not check for stale prices

devanas

Summary

LiquidationPool::distributeAssets() , we are using latestRoundData, but there is no check if the return value indicates stale data.

Vulnerability Details

According to Chainlink's documentation, it is important to provide additional checks that the data is fresh:

As you can see, both the line fetch data through Chainlink API but the updatedAt timestamp in the price feed response is not checked. So outdated prices may be used.

  • https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPool.sol#L207

(,int256 priceEurUsd,,,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();

  • https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPool.sol#L218

(,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
​

Impact

Oracle price feeds can become stale due to a variety of reasons. Using a stale price will result in incorrect calculations in most of the key
functionality of EUROs & and reward calculations.

Tools Used

Manual Review

Recommendations

Read the updatedAt parameter from the calls to latestRoundData() and verify that it isn't older than a set amount, eg:

(,int256 priceEurUsd,, uint256 updatedAt,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
if (updatedAt < block.timestamp - 60 * 60 /* beacause EUR/USD has the heartbeat of 1 hour*/) {
revert("stale price feed");
}
(,int256 assetPriceUsd,, uint256 updatedAt,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
if (updatedAt < block.timestamp - `heartbeatInterval` /* an interval because some price feed has heartbeat interval of 1 hour and some 24 hour and the `asset.token.clAdd` vary because it iterates over the all the assets*/) {
revert("stale price feed");
}
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Chainlink-price

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Chainlink-price

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.