IceBear - Lack of sufficient validation for chainlink price feed

[sherlock-admin]

IceBear

medium

Lack of sufficient validation for chainlink price feed

Summary

Lack of sufficient validation for chainlink price feed

Vulnerability Detail

the round id is not validated.

  function getPriceFromChainlink(address base, address quote) internal view returns (uint256) {
        (, int256 price,,,) = registry.latestRoundData(base, quote);
        require(price > 0, "invalid price");

        // Extend the decimals to 1e18.
        return uint256(price) * 10 ** (18 - uint256(registry.decimals(base, quote)));
    }

Impact

latestRoundData() might return stale results.

Code Snippet

https://github.com/sherlock-audit/2023-05-ironbank/blob/main/ib-v2/src/protocol/oracle/PriceOracle.sol#L66-L72

Tool used

Manual Review

Recommendation

Add roundId check

Duplicate of #9