Oracle has no check for timestamp

Summary

There is no validation done on timestamp returned from latestRoundData(). The borrower could borrow assets beyond his limit with the stale price.

Vulnerability Detail

The price oracle does not check round completeness.

function getPriceFromChainlink(address base, address quote) internal view returns (uint256) {
    (, int256 price,,,) = registry.latestRoundData(base, quote);
    require(price > 0, "invalid price");

    // Extend the decimals to 1e18.
    return uint256(price) * 10 ** (18 - uint256(registry.decimals(base, quote)));
}

Impact

The borrower could borrow assets beyond his limit with the wrong price and leave a bad debt.

Code Snippet

https://github.com/sherlock-audit/2023-05-ironbank/blob/main/ib-v2/src/protocol/oracle/PriceOracle.sol#L66-L72

Tool used

Manual Review

Recommendation

Validate the timestamp of the oracle is up to date.

Duplicate of #9

sherlock-audit / 2023-05-ironbank-judging

n33k - Oracle has no check for timestamp #387