DAI.latestRoundData returns data from the latest round, but there is no guarantee that the latest round happened frequently, it might be a case where latestRoundData has happened 1 hour or 1 day ago.
This can lead to stale data used for calculation and accounting.
check that startedAt and timestamp are within certain permissible bounds (for e.g difference between current timestamp and latest round timestamp is not more than 1 hour)
Handle
hack3r-0m
Vulnerability details
Location: https://github.com/code-423n4/2022-01-yield/blob/main/contracts/Cvx3CrvOracle.sol#L120-L122
DAI.latestRoundData
returns data from the latest round, but there is no guarantee that the latest round happened frequently, it might be a case where latestRoundData has happened 1 hour or 1 day ago.This can lead to stale data used for calculation and accounting.
Tools Used
Manual Review
Recommended Mitigation Steps
check that
startedAt
andtimestamp
are within certain permissible bounds (for e.g difference between current timestamp and latest round timestamp is not more than 1 hour)