Chainlink’s latestRoundData might return stale or incorrect results

Summary

The ChainlinkAdapter calls out to a Chainlink oracle receiving the latestRoundData(). If there is a problem with Chainlink starting a new round and finding consensus on the new value for the oracle (e.g. Chainlink nodes abandon the oracle, chain congestion, vulnerability/attacks on the chainlink system) consumers of this contract may continue using outdated stale or incorrect data (if oracles are unable to submit no new round is started).

Vulnerability Detail

function _getOraclePriceUSD(
    AggregatorV3Interface feed,
    uint32 maxOracleUpdateDuration
) internal view returns (uint256 oraclePriceUSD) {

@> (, int256 oraclePriceUSDInt, , uint256 updatedAt, ) = feed.latestRoundData();

    if (block.timestamp - updatedAt > maxOracleUpdateDuration) {
        revert HOTOracle___getOraclePriceUSD_stalePrice();
    }

    oraclePriceUSD = oraclePriceUSDInt.toUint256();
}

Impact

stale price.

Code Snippet

https://github.com/sherlock-audit/2024-03-arrakis/blob/main/valantis-hot/src/HOTOracle.sol#L142

Tool used

Manual Review

Recommendation

require(oraclePriceUSDInt>0);

sherlock-audit / 2024-03-arrakis-judging

bareli - Chainlink’s latestRoundData might return stale or incorrect results #61