QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Chainlink 's `latestRoundData()` might return stale or incorrect results

Zealynx

Description

The ChainlinkOracle.sol contract's _getData() function retrieves price data from Chainlink's oracle but lacks crucial validation checks for stale or outdated data. While the function performs a basic validation that the price is greater than zero (require(data > 0, "INVLDDATA")), it fails to implement essential checks for:

  1. Round completeness

  2. Round ID consistency

  3. Timestamp staleness

The current implementation:

function _getData() internal view override returns (int216, uint40) {
(, /*uint80 roundID*/ int data, , /*uint startedAt*/ uint timestamp, ) =
/*uint80 answeredInRound*/ priceFeed.latestRoundData();
require(data > 0, "INVLDDATA");
data = data * int(10 ** normalizationFactor);
return (int216(data), uint40(timestamp));
}
​

Impact

The lack of proper validation could lead to:

  1. Usage of stale prices in critical protocol operations

  2. Acceptance of outdated round data that could be significantly different from current market prices

  3. Potential price manipulation if the oracle is not updating properly

  4. Risk of financial losses for users if incorrect prices are used for liquidations, collateral calculations, or trading operations

Mitigation

Add comprehensive validation checks in the _getData() function:

function _getData() internal view override returns (int216, uint40) {
(
uint80 roundId,
int256 data,
,
uint256 updatedAt,
uint80 answeredInRound
) = priceFeed.latestRoundData();
​
// Check for round completeness
require(answeredInRound >= roundId, "STALE_PRICE");
​
// Check if round has been updated
require(updatedAt > 0, "INCOMPLETE_ROUND");
​
// Check for stale data (e.g., 1 hour threshold)
require(
block.timestamp - updatedAt <= 1 hours,
"STALE_TIMESTAMP"
);
​
require(data > 0, "INVLDDATA");
data = data * int(10 ** normalizationFactor);
return (int216(data), uint40(updatedAt));
}
​

These changes ensure that:

  1. The returned round is complete

  2. The answer is from the latest round

  3. The price data is not stale

  4. The price is positive (existing check)

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

invalid_chainlink_staled_data_updateAt_roundId_known_issue

LightChaser: ## [Medium-4] Insufficient oracle validation

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.