Closed code423n4 closed 1 year ago
https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L6 https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L82 https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L116
Since Chainlink latestAnswer is deprecated, use latestRoundData instead. Since it is deprecated, there is chance of Chainlink to stop supporting this function.
latestAnswer
latestRoundData
uint price = feeds[token].feed.latestAnswer();
Manual Analysis
Use latestRoundData instead and add relvent check as well.
interface IChainlinkFeed { function decimals() external view returns (uint8); function latestRoundData() external view returns (uint); }
(uint80 roundId, int256 price, , uint256 updatedAt, uint80 answeredInRound) = feeds[token].feed.latestRoundData(); require(answeredInRound >= roundId, "Stale Price"); require(updatedAt != 0, "Round Not Complete");
Duplicate of #601
0xean marked the issue as duplicate
Issue marked as satisfactory as requested by 0xean
Simon-Busch marked the issue as duplicate of #584
Lines of code
https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L6 https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L82 https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L116
Vulnerability details
Impact
Since Chainlink
latestAnswer
is deprecated, uselatestRoundData
instead. Since it is deprecated, there is chance of Chainlink to stop supporting this function.Proof of Concept
https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L6 https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L82 https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L116
Tools Used
Manual Analysis
Recommended Mitigation Steps
Use
latestRoundData
instead and add relvent check as well.