Skip to content
This repository has been archived by the owner on Nov 26, 2023. It is now read-only.

Delvir0 - Chainlink lastestRoundData is not checked for stale or round completeness #874

Closed
sherlock-admin opened this issue May 24, 2023 · 0 comments
Labels
Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label Medium A valid Medium severity issue Reward A payout will be made for this issue

Comments

@sherlock-admin
Copy link
Contributor

sherlock-admin commented May 24, 2023

Delvir0

medium

Chainlink lastestRoundData is not checked for stale or round completeness

Summary

It currently has no checks at all

Vulnerability Detail

latestRoundData returns: (uint80 roundID, int256 price, uint256 startedAt, uint256 timeStamp, uint80 answeredInRound).
In order to ensure Chainlink returned the correct price, these needs to be checked.

Impact

Not checking returned values can result in wrong price calculations of getPriceUSD.

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleDAI.sol#L48

Tool used

Manual Review

Recommendation

Implement the following solution:
sherlock-audit/2023-02-blueberry-judging#94

Duplicate of #31

@github-actions github-actions bot closed this as completed Jun 5, 2023
@github-actions github-actions bot added Medium A valid Medium severity issue Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label labels Jun 5, 2023
@sherlock-admin sherlock-admin added the Reward A payout will be made for this issue label Jun 23, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label Medium A valid Medium severity issue Reward A payout will be made for this issue
Projects
None yet
Development

No branches or pull requests

1 participant