The Standard

Summary

The LiqudationPool.sol contract utilizes the latestRoundData function from Chainlink oracles without implementing checks for stale data. This exposes the contract to potential vulnerabilities associated with outdated or incorrect data.

Vulnerability Details

The ChainlinkAdapter relies on the latestRoundData function to obtain data from Chainlink oracles. However, the current implementation lacks checks to ensure the freshness of the data. Issues such as delays in starting new rounds, chain congestion, or attacks on the Chainlink system may lead to the consumption of outdated or inaccurate data by consumers of the contract.

Chainlink Documentation References:

• Historical Price Data

• FAQ - Checking for Previous Round Answers

Impact

The absence of checks for stale data in the LiqudationPool.sol contract can result in the use of outdated values for priceEurUsd and assetPriceUsd. This, in turn, may compromise the accuracy and reliability of financial calculations and decisions based on these values.

Tools Used

Manual Review

Recommendations

To mitigate the identified vulnerability, it is recommended to incorporate checks for stale data when retrieving information from the Chainlink oracles. The following example Solidity code snippets illustrate the suggested checks: