hl_ - Chainlink's latestRoundData may return stale or incorrect results

[github-actions]

hl_

medium

Chainlink's latestRoundData may return stale or incorrect results

Summary

Freshness check should be applied on Chainlink's latestRoundData() function to ensure that the latest answer is recent enough to be used.

Vulnerability Detail

In the current implementation of ChainlinkAdapterOracle.sol's latestRoundData() function, there a lack of proper freshness checks. This could lead to stale prices being used.

For example, if the market price of the token drops rapidly and Chainlink's feed does not get updated in a timely manner, the smart contract will continue to believe the token is worth more than the market value.

Impact

Stale prices may be used.

Code Snippet

https://github.com/sherlock-audit/2023-02-blueberry/blob/main/contracts/oracle/ChainlinkAdapterOracle.sol#L76-L83

Tool used

Manual Review

Recommendation

Consider adding the missing freshness check for stale price:

require(answer > 0, "Chainlink answer <= 0");
require(answeredInRound >= roundId, "Stale price");
require(updatedAt != 0, "Round not complete");

Duplicate of #94