Oracle might return stale or incorrect results (Cvx3CrvOracle.sol)
The _peek function in the contract Cvx3CrvOracle.sol fetches the daiPrice, usdcPrice, usdtPrice from a Chainlink aggregator using the latestRoundData function.
If there is a problem with Chainlink starting a new round and finding consensus on the new value for the oracle (e.g. Chainlink nodes abandon the oracle, chain congestion, vulnerability/attacks on the chainlink system) consumers of this contract may continue using outdated stale or incorrect data.
Handle
ye0lde
Vulnerability details
Impact
Oracle might return stale or incorrect results (Cvx3CrvOracle.sol)
The
_peek
function in the contract Cvx3CrvOracle.sol fetches thedaiPrice, usdcPrice, usdtPrice
from a Chainlink aggregator using thelatestRoundData
function. If there is a problem with Chainlink starting a new round and finding consensus on the new value for the oracle (e.g. Chainlink nodes abandon the oracle, chain congestion, vulnerability/attacks on the chainlink system) consumers of this contract may continue using outdated stale or incorrect data.Proof of Concept
https://github.com/code-423n4/2022-01-yield/blob/e946f40239b33812e54fafc700eb2298df1a2579/contracts/Cvx3CrvOracle.sol#L110-L127
Tools Used
Visual Studio Code, Remix
Recommended Mitigation Steps
I suggest the following changes including moving the calls to
latestRoundData
into a new function. Replace lines 120-127 with:and add the getPrices function: