search

code-423n4 / 2022-04-backd-findings

6 stars 4 forks source link

Oracle price could not be fresh #155

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-04-backd/blob/c856714a50437cb33240a5964b63687c9876275b/backd/contracts/oracles/ChainlinkOracleProvider.sol#L55

Vulnerability details

Vulnerability

On ChainlinkOracleProvider.sol#L55, we are using latestRoundData, but there are no validations that the data is not stale.

The current code is:

(, int256 answer, , uint256 updatedAt, ) = AggregatorV2V3Interface(feed).latestRoundData();

But is missing the checks to validate the data is stale

(uint80 round, int256 answer, , uint256 updatedAt, uint80 answeredInRound) = AggregatorV2V3Interface(feed).latestRoundData();
require(answeredInRound >= round, "Stale price");

This could affect in all the logic, including funds.

chase-manning commented 2 years ago

Duplicate of #17