Closed sherlock-admin closed 1 year ago
Chom
medium
WstETHChainlinkOracle is missing a check for stale price in roundID
(/* */, int256 basePrice, /* */, uint256 bpUpdatedAt, /* */) = baseOracle.oracle.latestRoundData(); require(block.timestamp - bpUpdatedAt <= maxOracleFreshnessInSeconds); require(basePrice > 0); /// @dev: Chainlink Rate Error (/* */, int256 quotePrice, /* */, uint256 qpUpdatedAt, /* */) = quoteOracle.oracle.latestRoundData(); require(block.timestamp - qpUpdatedAt <= maxOracleFreshnessInSeconds); require(quotePrice > 0); /// @dev: Chainlink Rate Error
Only freshness and negative price are checked. Round ID check is being ignored.
This could lead to stale prices according to the Chainlink documentation:
https://docs.chain.link/docs/historical-price-data/#historical-rounds https://docs.chain.link/docs/faq/#how-can-i-check-if-the-answer-to-a-round-is-being-carried-over-from-a-previous-round
https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/trading/TradingModule.sol#L220-L226
Manual Review
Add round ID check
(uint80 baseRoundID, int256 basePrice, /* */, uint256 bpUpdatedAt, uint80 baseAnsweredInRound) = baseOracle.oracle.latestRoundData(); require(baseAnsweredInRound >= baseRoundID, "Stale price"); require(block.timestamp - bpUpdatedAt <= maxOracleFreshnessInSeconds); require(basePrice > 0); /// @dev: Chainlink Rate Error (uint80 quoteRoundID, int256 quotePrice, /* */, uint256 qpUpdatedAt, uint80 quoteAnsweredInRound) = quoteOracle.oracle.latestRoundData(); require(quoteAnsweredInRound >= quoteRoundID, "Stale price"); require(block.timestamp - qpUpdatedAt <= maxOracleFreshnessInSeconds); require(quotePrice > 0); /// @dev: Chainlink Rate Error
Duplicate of #133
Chom
medium
TradingModule oracle is missing check for stale price in roundID
Summary
WstETHChainlinkOracle is missing a check for stale price in roundID
Vulnerability Detail
Only freshness and negative price are checked. Round ID check is being ignored.
Impact
This could lead to stale prices according to the Chainlink documentation:
https://docs.chain.link/docs/historical-price-data/#historical-rounds https://docs.chain.link/docs/faq/#how-can-i-check-if-the-answer-to-a-round-is-being-carried-over-from-a-previous-round
Code Snippet
https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/trading/TradingModule.sol#L220-L226
Tool used
Manual Review
Recommendation
Add round ID check
Duplicate of #133