volodya - Chainlink's latestRoundData return stale or incorrect result for ChainlinkExpandAdaptor

[sherlock-admin]

volodya

medium

Chainlink's latestRoundData return stale or incorrect result for ChainlinkExpandAdaptor

Summary

Chainlink's latestRoundData returns stale or incorrect result

Vulnerability Detail

    function getMarkPrice() external view returns (uint256 price) {
        int256 rawPrice;
        uint256 updatedAt;
        (, rawPrice, , updatedAt, ) = IChainlink(chainlink).latestRoundData();
        (, int256 USDCPrice,, uint256 USDCUpdatedAt,) = IChainlink(USDCSource).latestRoundData();
        require(
            block.timestamp - updatedAt <= heartbeatInterval,
            "ORACLE_HEARTBEAT_FAILED"
        );
        require(block.timestamp - USDCUpdatedAt <= heartbeatInterval, "USDC_ORACLE_HEARTBEAT_FAILED");
        uint256 tokenPrice = (SafeCast.toUint256(rawPrice) * 1e8) / SafeCast.toUint256(USDCPrice);
        return tokenPrice * 1e18 / decimalsCorrection;
    }

contracts/adaptor/chainlinkAdaptor.sol#L43

Impact

Code Snippet

Tool used

Related report: sherlock-audit/2023-02-blueberry-judging#94
Manual Review

Recommendation

Add the below check for returned data

    function getMarkPrice() external view returns (uint256 price) {
        int256 rawPrice;
        uint256 updatedAt;
        (uint80 roundId, int256 price,uint256 startedAt, uint256 updatedAt,) = IChainLinkAggregator(chainlink).latestRoundData();
        (uint80 USDCroundId, int256 USDCPrice,uint256 USDCstartedAt, uint256 USDCUpdatedAt,) = IChainLinkAggregator(USDCSource).latestRoundData();

        //Solution
        require(updatedAt >= roundID, "Stale price");
        require(USDCUpdatedAt >= USDCroundId, "Stale price");
        require(startedAt != 0,"Round not complete");
        require(USDCstartedAt != 0,"Round not complete");
        require(price > 0,"Chainlink answer reporting 0");
        require(USDCPrice > 0,"Chainlink answer reporting 0");

        require(
            block.timestamp - updatedAt <= heartbeatInterval,
            "ORACLE_HEARTBEAT_FAILED"
        );
        require(block.timestamp - USDCUpdatedAt <= heartbeatInterval, "USDC_ORACLE_HEARTBEAT_FAILED");
        uint256 tokenPrice = (SafeCast.toUint256(price) * 1e8) / SafeCast.toUint256(USDCPrice);
        return tokenPrice * 1e18 / decimalsCorrection;
    }

Duplicate of #173