search

code-423n4 / 2021-06-tracer-findings

1 stars 0 forks source link

Using deprecated Chainlink function `latestAnswer` #145

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

shw

Vulnerability details

Impact

According to Chainlink's documentation, the latestAnswer function is deprecated. This function does not error if no answer has been reached but returns 0. Besides, the latestAnswer is reported with 18 decimals for crypto quotes but 8 decimals for FX quotes (See Chainlink FAQ for more details). A best practice is to get the decimals from the oracles instead of hard-coding them in the contract.

Proof of Concept

Referenced code: ChainlinkOracleAdapter.sol#L30 GasOracle.sol#L32-L33

Referenced documentation: Chainlink - Deprecated API Reference Chainlink - FAQ Chainlink - Migration Instructions Chainlink - API Reference

Recommended Mitigation Steps

Use the latestRoundData function to get the price instead. Add checks on the return data with proper revert messages if the price is stale or the round is uncomplete, for example:

(uint80 roundID, int256 price, , uint256 timeStamp, uint80 answeredInRound) = oracle.latestRoundData();
require(answeredInRound >= roundID, "...");
require(timeStamp != 0, "...");
loudoguno commented 3 years ago

closing as duplicate of #73