code-423n4 / 2021-05-fairside-findings

0 stars 0 forks source link

Chainlink Price data could be stale #62

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

s1m0

Vulnerability details

Impact

The function getEtherPrice() doesn't check if the return value is stale data. Stale data would mess up the calculation of amountOutMin for liquidateDai() and liquidateEth().

Recommended Mitigation Steps

Check that answeredInRound >= roundId as indicated in Chainlink documentation.

fairside-core commented 3 years ago

Duplicate of #70