search

code-423n4 / 2021-06-tracer-findings

1 stars 0 forks source link

Usage of deprecated ChainLink API in `OracleAdapter` #92

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

The Chainlink API (latestAnswer) used in the OracleAdapter oracle wrappers is deprecated:

This API is deprecated. Please see API Reference for the latest Price Feed API. Chainlink Docs

Impact**

It seems like the old API can return stale data. Checks similar to that of the new API using latestTimestamp and latestRoundare are needed. This could lead to stale prices according to the Chainlink documentation:

Recommended Mitigation Steps

Add the recommended checks:

(
    uint80 roundID,
    int256 price,
    ,
    uint256 timeStamp,
    uint80 answeredInRound
) = chainlink.latestRoundData();
require(
    timeStamp != 0,
    “ChainlinkOracle::getLatestAnswer: round is not complete”
);
require(
    answeredInRound >= roundID,
    “ChainlinkOracle::getLatestAnswer: stale data”
);
require(price != 0, "Chainlink Malfunction”);
raymogg commented 3 years ago

Duplicate of #145

cemozerr commented 3 years ago

Marking this as invalid as it seems to be the same issue submitted twice by the same user: https://github.com/code-423n4/2021-06-tracer-findings/issues/91