Submission Details
Severity:
No check for oracle stale price
Summary
Calls to Oracles don't check for stale prices.
Vulnerability Details
None of the oracle calls check for stale prices, opening potential staleness issues:
(,int256 priceEurUsd,,,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
(,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
Impact
Potential for incorrect/outdated prices
Tools Used
Manual review
Recommendations
Read the updatedAt parameter from the calls to latestRoundData() and verify that it isn't older than a set amount, eg:
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
Chainlink-price
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.