Calls to Oracles don't check for stale prices.
Many of the oracle calls do not check for stale prices. Oracle data feeds can return stale pricing data for a variety of reasons. If the returned pricing data is stale, this code will execute with prices that don’t reflect the current pricing resulting in a potential loss of funds for the user and/or the protocol
lack of stale answer check can lead to loss of funds to the users and or the protocol
Manual review
Smart contracts should always check the updatedAt
parameter returned from latestRoundData()
and compare it to a staleness threshold
The staleness threshold should correspond to the heartbeat of the oracle’s price feed. This can be found on Chainlink’s list of Ethereum mainnet price feeds by checking the “Show More Details” box, which will show the “Heartbeat” column for each feed. In the case of clEurUsd
, it's an an hour.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.