Submission Details
Severity:
Chainlink's `latestRoundData` might return stale or incorrect results
Summary
In LiquidationPool, we're using latestRoundData but there is no check if the return value indicates stale data.
Vulnerability Details
function distributeAssets(ILiquidationPoolManager.Asset[] memory _assets, uint256 _collateralRate, uint256 _hundredPC) external payable {
(,int256 priceEurUsd,,,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData(); <--
if (_positionStake > 0) {
for (uint256 i = 0; i < _assets.length; i++) {
ILiquidationPoolManager.Asset memory asset = _assets[i];
if (asset.amount > 0) {
(,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData(); <--
}
} else {}
}
}
}
}
}
However, this doesn't check if the price provided is from the latest round. For some reason, the oracle could be frozen and give stale price data.
Impact
Incorrect or stale rice returned from Chainlink oracle could lead to different problems like incorrect calculations or even incurring a bad debt if a user borrows against an asset with an incorrect price.
Tools Used
Manual review
Recommendations
Implement the following correction:
(uint80 roundId, int256 assetPriceUsd,, uint256 updatedAt, uint80 answeredInRound) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
require(answeredInRound >= roundID, "Stale price");
require(block.timestamp - updatedAt < PRICE_ORACLE_STALE_THRESHOLD, "Price round incomplete");
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
Chainlink-price
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.