Stader Labs - Hama's results

Lines of code

https://github.com/code-423n4/2023-06-stader/blob/main/contracts/StaderOracle.sol#L646 https://github.com/code-423n4/2023-06-stader/blob/main/contracts/StaderOracle.sol#L649

Vulnerability details

Impact

The impact of this finding is that it can lead to the usage of stale prices across various functions in the affected contracts. When retrieving data from Chainlink's latestRoundData() API, there are no checks for stale data, which can result in the utilization of outdated price information. This vulnerability has the potential to cause financial losses to end-users who rely on accurate and up-to-date price data.

Proof of Concept

function getPORFeedData() internal view returns ( uint256, uint256, uint256) {
(, int256 totalETHBalanceInInt, , , ) = AggregatorV3Interface(staderConfig.getETHBalancePORFeedProxy()).latestRoundData();
(, int256 totalETHXSupplyInInt, , , ) = AggregatorV3Interface(staderConfig.getETHXSupplyPORFeedProxy()).latestRoundData();
return (uint256(totalETHBalanceInInt), uint256(totalETHXSupplyInInt), block.number);
}

Tools Used

manual review

Recommended Mitigation Steps

Consider adding the missing checks for stale data. For example:

(uint80 roundID, int256 answer,, uint256 timestamp, uint80 answeredInRound) = AggregatorV3Interface(chainLinkAggregatorMap[underlying]).latestRoundData();
require(answer > 0, "Chainlink price <= 0");
require(answeredInRound >= roundID, "Stale price");
require(timestamp != 0, "Round not complete");

Assessed type

Oracle