Submission Details
Severity:
Chainlink's latestRoundData return stale or incorrect result
Summary
Vulnerability Details
On LiquidationPool, you are using latestRoundData, but there is no check if the return value indicates stale data. This could lead to stale prices according to the Chainlink documentation: https://docs.chain.link/data-feeds/price-feeds/historical-data
Impact
The returnUnpurchasedNative function in the contract LiquidationPool fetches the eurUsd price from a Chainlink aggregator using the latestRoundData function. However, there are no checks on roundID nor timeStamp, resulting in stale prices.
Tools Used
Manual Review
Recommendations
(uint80 roundID, int256 priceEurUsd, , uint256 timeStamp, uint80 answeredInRound) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
require(answeredInRound >= roundID, "...");
require(timeStamp != 0, "...");
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
Chainlink-price
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.