Submission Details
Severity:
There is no stale price check in the `ChainlinkOracle` contract or the `MultiHopOracle` contract, which means the oracle may send outdated data.
Summary
The ChainlinkOracle contract and MultiHopOracle contract do not have any stale price check implemented.
Vulnerability Details
The ChainlinkOracle and MultiHopOracle contracts can provide outdated data or price feeds because the _getData funciton in them do not implementation to check for stale prices.
Impact
The calculation will be done with outdated data, causing both the user and the protocol to lose value.
Tools Used
Manual review
Recommendations
Make a MAX_DATA_AGE variable and implemet the following in both contract.
+ require(block.timestamp - timestamp <= MAX_DATA_AGE, "Stale oracle data");
Updates
Lead Judging Commences
n0kto 10 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
invalid_chainlink_staled_data_updateAt_roundId_known_issue
LightChaser: ## [Medium-4] Insufficient oracle validation
Prize pool breakdown
Total prize
49,600 OP
nSLOC
3,00017
OP / LOC
44,640
4,960
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.