sl1 - Medim severity - No check for stale price feeds

[sherlock-admin]

sl1

medium

Medim severity - No check for stale price feeds

Summary

getPriceFromChainlink function in PriceOracle.sol does not check for price feed staleness which can lead to wrong price return value.

Vulnerability Detail

Oracle data feed is insufficiently validated. There is no check for stale price. Price can be stale and lead to wrong return value.

Impact

Stale data can lead to wrong price.

Code Snippet

(, int256 price,,,) = registry.latestRoundData(base, quote);
 require(price > 0, "invalid price");

https://github.com/sherlock-audit/2023-05-ironbank/blob/9ebf1702b2163b55479624794ab7999392367d2a/ib-v2/src/protocol/oracle/PriceOracle.sol#L67

Tool used

Manual Review

Recommendation

(, int256 price,, uint256 updatedAt, ) = registry.latestRoundData(base, quote);
        if(updatedAt < block.timestamp - 60 * 60 /* 1 hour */) {
            revert("stale price feed");
        } 
        require(price > 0, "invalid price");

The potential solution is to validate that no more than 1 hour has passed from the "updatedAt" timestamp value returned from "latestRoundData()", otherwise the transaction will revert

Duplicate of #9