Prices from Chainlink are fetched using a deprecated function.
Impact
The ChainlinkPriceOracle contract is used to interface with Chainlink price feeds to obtain the prices for the different LST assets used in the protocol.
The implementation is using the function latestAnswer() which is deprecated and should not be used anymore.
latestAnswer
⚠️ THIS FUNCTION IS DEPRECATED. DO NOT USE THIS FUNCTION.
Proof of Concept
The implementation of getAssetPrice() is using the deprecated function:
Lines of code
https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/oracles/ChainlinkPriceOracle.sol#L38
Vulnerability details
Summary
Prices from Chainlink are fetched using a deprecated function.
Impact
The ChainlinkPriceOracle contract is used to interface with Chainlink price feeds to obtain the prices for the different LST assets used in the protocol.
The implementation is using the function
latestAnswer()
which is deprecated and should not be used anymore.Proof of Concept
The implementation of
getAssetPrice()
is using the deprecated function:https://github.com/code-423n4/2023-11-kelp/blob/f751d7594051c0766c7ecd1e68daeb0661e43ee3/src/oracles/ChainlinkPriceOracle.sol#L37-L39
Recommendation
Switch to
latestRoundData()
.Assessed type
Oracle