Liquidity Management

Summary

The _check function is responsible for validating price data using Chainlink's latestRoundData(). However, it does not validate the roundId, which is crucial for ensuring data correctness, freshness, and integrity.

Without roundId validation, the function may process incomplete, stale, or manipulated price data, leading to incorrect price calculations and potential financial risks.

Vulnerability Details

The function retrieves data using latestRoundData(), but it does not check the roundId. The function directly uses the returned chainLinkPrice without verifying the roundId. If Chainlink's oracle returns stale or incomplete data, the contract might still use the price, leading to incorrect calculations.

Impact

Using outdated price data if Chainlink has not updated recent prices.

Accepting incomplete rounds where the price feed might still be changing.

Positions open on wrong collateral prices which may cost major financial losses to the protocol.

Incorrect collateral valuation can cause under-collateralization.

Tools Used

Manual Review

Recommendations

To mitigate the risk, latestRoundData function returns the answeredInRound value among other returned values. Although this value is depreacated as mentioned in the docs but still this can be used to validate the roundId. Another way is to check the startedAt timestamp because each roundData has this prop. The implication should be like, startedAt should be greater than last startedAt this will ensure that price does not pertain to previous round and the price is fresh and udpated.