code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L116

Vulnerability details

Impact

Chainlink has deprecated their latestAnswer() API in favor of the latestRoundData(). The returned data should also be checked to be recent. Stale data could lead to a miscalculation of collateral value.

Proof of Concept

The Oracle's GetPrice() uses a deprecated function of the Chainlink API

function getPrice(address token, uint collateralFactorBps) external returns (uint) {
    ...
    uint price = feeds[token].feed.latestAnswer();

Tools Used

Manual review

Recommended Mitigation Steps

Use the latestRoundData() and check if the data is recent by comparing the roundIdand answeredInRound values.

function getPrice(address token, uint collateralFactorBps) external returns (uint) {
    ...
    uint price = feeds[token].feed.latestAnswer();
    require(answeredInRound >= roundID, "Stale price data.");