/// @notice Returns the price of ETH in terms of the keeper token
/// @return The price of ETH in terms of the keeper token
function _etherPrice() private view returns (UFixed18) {
(, int256 answer, , ,) = ethTokenOracleFeed().latestRoundData();//@audit oracle freshness.
return UFixed18Lib.from(Fixed18Lib.ratio(answer, 1e8)); // chainlink eth-usd feed uses 8 decimals
}
Tool used
Manual Review
Recommendation
Validate the freshness of the price from the oracle.
/// @notice Returns the price of ETH in terms of the keeper token
/// @return The price of ETH in terms of the keeper token
function _etherPrice() private view returns (UFixed18) {
(uint80 roundID, int256 answer, ,uint256 updatedAt ,uint80 answeredInRound) = ethTokenOracleFeed().latestRoundData();//@audit oracle freshness.
++ require(block.timestamp <= updatedAt + stalePriceDelay, "Stale price");
++ require(answeredInRound >= roundID, "Stale price");
return UFixed18Lib.from(Fixed18Lib.ratio(answer, 1e8)); // chainlink eth-usd feed uses 8 decimals
}
kaysoft
medium
Chainlink Oracle Price freshness not checked.
Summary
Price freshness from the chainlink oracle not validated
Vulnerability Detail
Price freshness from the chainlink oracle not validated
Impact
Loss of due to use of stale price from oracle
Code Snippet
https://github.com/sherlock-audit/2023-07-perennial/blob/main/root/contracts/attribute/Kept.sol#L62
Tool used
Manual Review
Recommendation
Validate the freshness of the price from the oracle.
Duplicate of #159