csanuragjain - Improper Validation Of latestRoundData Function

[github-actions]

csanuragjain

medium

Improper Validation Of latestRoundData Function

Summary

Additional checks on latestRoundData is missing. This means even a stale price is accepted and returned to user

Vulnerability Detail

Necessary checks are missing while using latestRoundData function which means the returned price might be stale

Impact

Price returned could be stale

Code Snippet

https://github.com/sherlock-audit/2023-02-blueberry/blob/main/contracts/oracle/ChainlinkAdapterOracle.sol#L76-L83

Tool used

Manual Review

Recommendation

Change the implementation as below :

        (uint80 latestRoundId, int answer,,uint256 updatedAt,uint80 answeredInRound) =
           registry.latestRoundData(
            token,
            USD
        );

      require (answer >= 0, "Negative price");
      require(answeredInRound >= latestRoundId,"Price Stale" );
        ...

Duplicate of #94