Stale Prices could be returned due to lack of rounding chek on the getLatestPrie Function.

Summary

There is no check in the getLatestPrice() function of the oracles for round completeness, or the returned timestamp, and this could lead to stale, outdated, or wrong price return value, which could affect other functions that depend on the getLatestPrice() function.

Vulnerability Detail

In the XOracle.sol contract the getLatestPrice

    function getLatestPrice(address asset) public view returns (uint256) {
        return prices[asset].price;
    }

According to Chainlink's documentation, this function does not error if no answer has been reached but returns 0 or outdated round data. The external Chainlink oracle, which provides index price information to the system, introduces risk inherent to any dependency on third-party data sources. For example, the oracle could fall behind or otherwise fail to be maintained, resulting in outdated data being fed to the index price calculations. Oracle's reliance has historically resulted in crippled on-chain systems , and complications that lead to these outcomes can arise from things as simple as network congestion . More Information/Reason for this Click this

Impact

This could lead to stale prices and wrong price return value, or outdated prices. As a result, the functions that rely on accurate price feed might not work as expected due to wrong calculations made with stale prices, which sometimes can lead to fund loss. The impacts vary and depend on specific situations.

Code Snippet

getLatestPrice ~ https://github.com/sherlock-audit/2023-04-unitasprotocol/blob/main/Unitas-Protocol/src/XOracle.sol#LL49C4-L56C6
Tool used

Manual Review

Recommendation

Validate getLatestPrice() for round completeness and for returned timestamp

sherlock-audit / 2023-04-unitasprotocol-judging

okolicodes - Stale Prices could be returned due to lack of rounding chek on the getLatestPrie Function. #135