Summary

Oracle data feeds can return stale pricing data for a variety of reasons. If the returned pricing data is stale, this code will execute with prices that don’t reflect the current pricing resulting in a potential loss of funds for the user and/or the protocol. Smart contracts should always check the updatedAt parameter returned from latestRoundData() and compare it to a staleness threshold.

Vulnerability Details

In below we can see function distributeAssets() directly fetch the price and used for further operations without check it possess the security risk.

We can see above code says that assetPriceUsd value return by oracles and directly used for further operations like to determine the costInEuros. If data returned are staled it directly affects the users or liquidators.

Impact

Price return by orcales can be staled and affects users or liquidators

Tools Used

Manual View

Recommendations

We recommend that implement proper check for price return from orcales. Which is officially mentioned by ChainLink protocol.