The Standard

Summary

distributeAssets() is using chainlink latestRoundData(), but there is no check if the return value indicates stale or incorrect data. As per of Chainlink documentation, This could lead to stale prices or incorrect data.

Vulnerability Details

The consult function in the contract LiquidationPool.sol fetches the asset price from a Chainlink aggregator using the latestRoundData function. However, there are no checks on the return values, resulting in stale prices. The oracle wrapper calls out to a chainlink oracle receiving the latestRoundData(). But it dosen't check the freshness by verifying that the answer is indeed for the last known round. The returned updatedAt timestamp is not checked.

If there is a problem with chainlink starting a new round and finding consensus on the new value for the oracle (e.g. chainlink nodes abandon the oracle, chain congestion, vulnerability/attacks on the chainlink system) consumers of this contract may continue using outdated stale data (if oracles are unable to submit no new round is started)

Impact

latestRoundData() can return stale or incorrect data.

Tools Used

Manual review

Recommendations

Revert if the return value indicates stale or incorrect data: