Staleness TIMEOUT of 72 hours far exceeds Chainlink feed heartbeats, so multi-hour-stale prices are treated as fresh

Severity: Low · Impact: Medium · Likelihood: Low

Description

• The oracle library exists specifically to freeze the protocol when a Chainlink feed goes stale (per its own docstring: "If a price is stale, functions will revert... We should use the Chainlink feed heartbeat to determine if a feed is stale or not"). The correct freshness bound for a feed is its heartbeat — the maximum interval Chainlink guarantees between updates.

• Instead, the library hardcodes a single TIMEOUT of 72 * 3600 (259,200 seconds = 72 hours) and applies it to every feed. The collateral feeds it guards — ETH/USD and BTC/USD — have heartbeats on the order of ~1 hour (and a 0.5% deviation threshold). A 72-hour window is therefore roughly 70× longer than the feed's actual staleness bound, so a price that has not updated for up to ~71 hours past its heartbeat is still treated as fresh and used verbatim in every collateral valuation.

• Because the same constant is shared across all feeds, it also cannot be right for a fork that adds feeds with different heartbeats — directly at odds with the "swap out WETH & WBTC for any basket of assets" design goal, where each new feed may have a materially different heartbeat.

Risk

Likelihood:

• Occurs whenever a feed stops updating for longer than its heartbeat but less than 72 hours — a routine Chainlink degradation (feed pause, sequencer/oracle hiccup, market halt) that this check is meant to catch but silently accepts for up to three days.

Impact:

• Every price-dependent action — deposit_collateral_and_mint_dsc, mint_dsc, redeem_collateral, and liquidate — executes against a price up to 72 hours old, mispricing collateral for the entire window.

• During a fast price move that a stale feed hasn't reflected, this enables both under-collateralized minting (borrowing against an overstated collateral value) and wrongful liquidations (positions liquidated on an outdated price), i.e. direct value loss on both sides while the feed is stale-but-within-72h.

Proof of Concept

Save the block below as tests/poc_l1.py inside the cloned repo and run mox test tests/poc_l1.py. A price that has not updated for 71 hours — ~70 heartbeats stale — is still accepted and used; only past the full 72-hour window does the guard finally revert.

Recommended Mitigation

Replace the single global 72-hour constant with a per-feed timeout sized to each feed's actual heartbeat (plus a small buffer), stored alongside the price-feed mapping when a collateral/feed is registered, and validate seconds_since against that per-feed value.