The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

No check of stale price in chainlink request

sovaslava

Summary

There is not check of stale prices, after receiving price from chainlink feed.

Vulnerability Details

The latestRoundData function in the contract LiquidationPool.sol fetches the asset price from a Chainlink aggregator using the latestRoundData function. However, there are no checks on roundID.
Stale prices could put funds at risk. According to Chainlink's documentation, This function does not error if no answer has been reached but returns 0, causing an incorrect price fed to the LiquidationPool contract. The external Chainlink oracle, which provides index price information to the system, introduces risk inherent to any dependency on third-party data sources. For example, the oracle could fall behind or otherwise fail to be maintained, resulting in outdated data being fed to the index price calculations.

https://docs.chain.link/data-feeds/api-reference/

Impact

Contract will receive incorrect price of assets

Tools Used

Manual review

Recommendations

Add additional checks, and new variable - heartbeat_time, with value (for example 3 hours)

(uint80 roundID, int256 price, , uint256 timeStamp, uint80 answeredInRound) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
require(price > 0, "Chainlink price <= 0");
require(timeStamp != 0, "...");
require(timeStamp >= block.timestamp - heartbeat_time , "Stale pricefeed");
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Chainlink-price

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Chainlink-price

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.