lack of validations in possibly deprecated oracle

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-11-kelp/blob/4b34abc952205e2a34bff893a0de0c75b8052149/src/oracles/ChainlinkPriceOracle.sol#L38

Vulnerability details

Impact

• L38 - The latestAnswer() function of the aggregator is used, in the "ChainLink Price Feeds" section of https://blog.openzeppelin.com/secure-smart-contract-guidelines-the-dangers-of-price-oracles it is explained that this could generate security errors, when using a depreciated version of the oracle. Furthermore, it is not validated that the return is != 0, this would be important since the oracle could be working incorrectly.

Recommended Mitigation Steps

Use try/catch and validate that the result of latestAnswer() is != 0.

Assessed type

Oracle

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as primary issue

[raymondfam]

L-02 from the bot.

[c4-judge]

fatherGoose1 marked the issue as unsatisfactory: Invalid

[fatherGoose1]

Reported by bot.

[c4-judge]

fatherGoose1 marked the issue as unsatisfactory: Invalid

[c4-judge]

fatherGoose1 marked the issue as unsatisfactory: Invalid