m9800 - M-1 : chainlinkAdaptor.sol getMarkPrice() return stale or incorrect result

[sherlock-admin]

m9800

medium

M-1 : chainlinkAdaptor.sol getMarkPrice() return stale or incorrect result

Summary

Vulnerability Detail

Impact

The function getMarkPrice() in chainlinkAdaptor.sol is using IChainlink(chainlink).latestRoundData() but no check on roundId is performed and prices could be stale data.

Code Snippet

https://github.com/JOJOexchange/smart-contract-EVM/blob/4a95a8e9a6367ae88dc827e29467229cb5bbad4f/contracts/adaptor/chainlinkAdaptor.sol#L43

    function getMarkPrice() external view returns (uint256 price) {
        int256 rawPrice;
        uint256 updatedAt;
        (, rawPrice, , updatedAt, ) = IChainlink(chainlink).latestRoundData();
        (, int256 USDCPrice,, uint256 USDCUpdatedAt,) = IChainlink(USDCSource).latestRoundData();
        require(
            block.timestamp - updatedAt <= heartbeatInterval,
            "ORACLE_HEARTBEAT_FAILED"
        );
        require(block.timestamp - USDCUpdatedAt <= heartbeatInterval, "USDC_ORACLE_HEARTBEAT_FAILED");
        uint256 tokenPrice = (SafeCast.toUint256(rawPrice) * 1e8) / SafeCast.toUint256(USDCPrice);
        return tokenPrice * 1e18 / decimalsCorrection;
    }

Tool used

Manual Review

Recommendation

        require(updatedAt >= roundID, "Stale price");
        require(timestamp != 0,"Round not complete");
        require(answer > 0,"Chainlink answer reporting 0");

Similar issue: sherlock-audit/2023-02-blueberry-judging#94

Duplicate of #173