BugHunter101 - D3Oracle.getPrice() use latestRoundData() return stale or incorrect result

[sherlock-admin]

BugHunter101

medium

D3Oracle.getPrice() use latestRoundData() return stale or incorrect result

Summary

D3Oracle.getPrice() use latestRoundData() return stale or incorrect result

Vulnerability Detail

function getPrice(address token) public view override returns (uint256) {
        require(priceSources[token].isWhitelisted, "INVALID_TOKEN");
        AggregatorV3Interface priceFeed = AggregatorV3Interface(priceSources[token].oracle);
        (uint80 roundID, int256 price,, uint256 updatedAt, uint80 answeredInRound) = priceFeed.latestRoundData();//@audit
        require(price > 0, "Chainlink: Incorrect Price");
        require(block.timestamp - updatedAt < priceSources[token].heartBeat, "Chainlink: Stale Price");
        require(answeredInRound >= roundID, "Chainlink: Stale Price");
        return uint256(price) * 10 ** (36 - priceSources[token].priceDecimal - priceSources[token].tokenDecimal);
    }

Impact

This could lead to stale prices according to the Chainlink documentation:
https://docs.chain.link/data-feeds/price-feeds/historical-data
Related report:
code-423n4/2021-05-fairside-findings#70

Code Snippet

https://github.com/sherlock-audit/2023-06-dodo/blob/main/new-dodo-v3/contracts/DODOV3MM/periphery/D3Oracle.sol#L51

Tool used

Manual Review

Recommendation

such as sherlock-audit/2023-02-blueberry-judging#94

Duplicate of #129