The Standard

Summary

On LiquidationPool.sol, we are using latestRoundData, but there is no check if the return value indicates stale data.

Vulnerability Details

Chainlink’s latestRoundData is used here to retrieve price feed data; however, there is insufficient protection against price staleness. Return arguments other than int256 answer are necessary to determine the validity of the returned price, as it is possible for an outdated price to be received.

Impact

latestRoundData function is used in the distributeAssets function in the LiquidationPool.sol contract

    function distributeAssets(ILiquidationPoolManager.Asset[] memory _assets, uint256 _collateralRate, uint256 _hundredPC) external payable {
    consolidatePendingStakes();
    (,int256 priceEurUsd,,,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
    uint256 stakeTotal = getStakeTotal();
    uint256 burnEuros;
    uint256 nativePurchased;
    for (uint256 j = 0; j < holders.length; j++) {
        Position memory _position = positions[holders[j]];
        uint256 _positionStake = stake(_position);
        if (_positionStake > 0) {
            for (uint256 i = 0; i < _assets.length; i++) {
                ILiquidationPoolManager.Asset memory asset = _assets[i];
                if (asset.amount > 0) {
                    (,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
                    uint256 _portion = asset.amount * _positionStake / stakeTotal;
                    uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd)
                        * _hundredPC / _collateralRate;
                    if (costInEuros > _position.EUROs) {
                        _portion = _portion * _position.EUROs / costInEuros;
                        costInEuros = _position.EUROs;
                    }
                    _position.EUROs -= costInEuros;
                    rewards[abi.encodePacked(_position.holder, asset.token.symbol)] += _portion;
                    burnEuros += costInEuros;
                    if (asset.token.addr == address(0)) {
                        nativePurchased += _portion;
                    } else {
                        IERC20(asset.token.addr).safeTransferFrom(manager, address(this), _portion);
                    }
                }
            }
        }
        positions[holders[j]] = _position;
    }
    if (burnEuros > 0) IEUROs(EUROs).burn(address(this), burnEuros);
    returnUnpurchasedNative(_assets, nativePurchased);
}

This could lead to stale prices according to the Chainlink documentation: https://docs.chain.link/data-feeds/price-feeds/historical-data

Tools Used

Manual Review

Recommendations

Use the following code:

    function distributeAssets(ILiquidationPoolManager.Asset[] memory _assets, uint256 _collateralRate, uint256 _hundredPC) external payable {
    consolidatePendingStakes();
    (uint80 roundID, int256 priceEurUsd, uint256 timestamp, uint256 updatedAt,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
    require(updatedAt >= roundID, "Stale price");
    require(timestamp != 0,"Round not complete");
    require(priceEurUsd> 0,"Chainlink answer reporting 0");
    uint256 stakeTotal = getStakeTotal();
    uint256 burnEuros;
    uint256 nativePurchased;
    for (uint256 j = 0; j < holders.length; j++) {
        Position memory _position = positions[holders[j]];
        uint256 _positionStake = stake(_position);
        if (_positionStake > 0) {
            for (uint256 i = 0; i < _assets.length; i++) {
                ILiquidationPoolManager.Asset memory asset = _assets[i];
                if (asset.amount > 0) {
                    (uint80 roundID,int256 assetPriceUsd, uint256 timestamp, uint256 updatedAt,) = 
                     Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
                    require(updatedAt >= roundID, "Stale price");
                    require(timestamp != 0,"Round not complete");
                    require(assetPriceUsd> 0,"Chainlink answer reporting 0");
                    uint256 _portion = asset.amount * _positionStake / stakeTotal;
                    uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd)
                        * _hundredPC / _collateralRate;
                    if (costInEuros > _position.EUROs) {
                        _portion = _portion * _position.EUROs / costInEuros;
                        costInEuros = _position.EUROs;
                    }
                    _position.EUROs -= costInEuros;
                    rewards[abi.encodePacked(_position.holder, asset.token.symbol)] += _portion;
                    burnEuros += costInEuros;
                    if (asset.token.addr == address(0)) {
                        nativePurchased += _portion;
                    } else {
                        IERC20(asset.token.addr).safeTransferFrom(manager, address(this), _portion);
                    }
                }
            }
        }
        positions[holders[j]] = _position;
    }
    if (burnEuros > 0) IEUROs(EUROs).burn(address(this), burnEuros);
    returnUnpurchasedNative(_assets, nativePurchased);
}