HexHackers - Possible stale price values from Chainlink oracle

[sherlock-admin]

HexHackers

medium

Possible stale price values from Chainlink oracle

Summary

No check for round completeness could lead to stale prices and wrong price return value, or outdated prices.

The functions that rely on accurate price feed might not work as expected, which sometimes can lead to fund loss.

Vulnerability Detail

The function getPriceFromChainlink in PriceOracle.sol does not check for round completeness.

function getPriceFromChainlink(address base, address quote) internal view returns (uint256) {
        (, int256 price,,,) = registry.latestRoundData(base, quote);
        require(price > 0, "invalid price");

        // Extend the decimals to 1e18.
        return uint256(price) * 10 ** (18 - uint256(registry.decimals(base, quote)));
    }

When getting latestRoundData, the only variable checked is the price.
However, according to Chainlink docs, answeredInRound should be checked to be == roundId

Impact

latestRoundData() might return stale results leading to wrong prices and potential loss of funds.

Code Snippet

https://github.com/sherlock-audit/2023-05-ironbank/blob/9ebf1702b2163b55479624794ab7999392367d2a/ib-v2/src/protocol/oracle/PriceOracle.sol#L66

Tool used

Manual Review

Recommendation

Add the check:

        require(answeredInRound == roundID, "Stale price");

Duplicate of #9