ChainLink price data could be stale

[code423n4]

Handle

cmichel

Vulnerability details

There is no check in UniswapV3Oracle.ethPrice if the return values indicate stale data. This could lead to stale prices according to the Chainlink documentation:

• under current notifications: "if answeredInRound < roundId could indicate stale data."
• under historical price data: "A timestamp with zero value means the round is not complete and should not be used."

It also seems to use the deprecated API (latestAnswer) and a hardcoded decimals of 1e8?

This API is deprecated. Please see API Reference for the latest Price Feed API. Chainlink Docs

Impact

Stale prices that do not reflect the current market price anymore could be used which would influence the liquidation pricing.

Recommendation

Add the recommended checks:

(
    uint80 roundID,
    int256 price,
    ,
    uint256 timeStamp,
    uint80 answeredInRound
) = chainlink.latestRoundData();
require(
    timeStamp != 0,
    “ChainlinkOracle::getLatestAnswer: round is not complete”
);
require(
    answeredInRound >= roundID,
    “ChainlinkOracle::getLatestAnswer: stale data”
);
require(price != 0, "Chainlink Malfunction”);

[talegift]

Duplicate #55