The Standard

Summary

No check for round completeness could lead to stale, wrong or outdated prices. The LiquidationPool:: distributeAssets function will register inaccurate rewards in case this happens.

Vulnerability Details

According to Chainlink's documentation, this function does not throw an error if no answer has been reached but returns 0 or outdated round data. The external Chainlink oracle, which provides index price information to the system, introduces risk inherent to any dependency on third-party data sources. For example, the oracle could fall behind or otherwise fail to be maintained, resulting in outdated data being fed to the index price calculations. Oracle reliance has historically resulted in crippled on-chain systems, and complications that lead to these outcomes can arise from things as simple as network congestion. All these complications can be mitigated with a couple of healthy checks.

Impact

If there is a problem with chainlink starting a new round and finding consensus on the new value for the oracle (e.g. chainlink nodes abandon the oracle, chain congestion, vulnerability/attacks on the chainlink system) consumers of this contract may continue using outdated stale data (if oracles are unable to submit no new round is started).
The use of outdated prices will significantly affect user’s rewards.

Tools Used

Manual review

Recommendations

A new mapping that links the feed addresses to their respective heartbeat needs to be created.
And then the following checks should be implemented:

The same solution can be applied for the other instance where .latestRoundData() is used.