The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Chainlink's `latestRoundData` may return a stale or incorrect result

auditism

Summary

Chainlink's latestRoundData is used here to retrieve price feed data; however, there is insufficient protection against price staleness.

Vulnerability Details

Return arguments other than int priceEurUsd (answer) are necessary to determine the validity of the returned price, as it is possible for an outdated price to be received.

https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPool.sol#L218

(,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();

https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPool.sol#L207

(,int256 priceEurUsd,,,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();

Impact

The imapact is severe as inaccurate price data can lead to functions not working as expected and/or loss of funds.

Tools Used

Manual review

https://ethereum.stackexchange.com/questions/133242/how-future-resilient-is-a-chainlink-price-feed/133843#133843

Recommendations

The return value updatedAt contains the timestamp at which the received price was last updated, and can be used to ensure that the price is not outdated.
Several checks need to be added as well, please integrate a similar implementation :

( uint80 roundID , priceEurUsd ,, uint256 timestamp , uint80
ë answeredInRound ) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
​
require ( priceEurUsd > 0, "" Chainlink price <= 0"");
require ( answeredInRound >= roundID , "" Stale price "");
require ( timestamp != 0, "" Round not complete "");"
​
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Chainlink-price

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Chainlink-price

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.