Phuture Finance contest - berndartmueller's results

Lines of code

https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ChainlinkPriceOracle.sol#L83 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ChainlinkPriceOracle.sol#L84

Vulnerability details

Impact

In ChainlinkPriceOracle.sol, latestRoundData() is used but there is no check if the return value indicates stale data. This could lead to stale prices according to the Chainlink documentation:

• https://docs.chain.link/docs/historical-price-data/#historical-rounds
• https://docs.chain.link/docs/faq/#how-can-i-check-if-the-answer-to-a-round-is-being-carried-over-from-a-previous-round

Proof of Concept

ChainlinkPriceOracle.sol#L83
ChainlinkPriceOracle.sol#L84

Tools Used

Manual review

Recommended mitigation steps

Additionally to the already existing check require(basePrice > 0 && quotePrice > 0, "ChainlinkPriceOracle: NEGATIVE"); consider adding checks for stale data.

(uint80 basePriceRoundID, int basePrice, , uint256 basePriceTimestamp, uint80 basePriceAnsweredInRound) = baseAggregator.latestRoundData();
(uint80 quotePriceRoundID, int quotePrice, , uint256 quotePriceTimestamp, uint80 quotePriceAnsweredInRound) = assetInfo.aggregator.latestRoundData();

require(basePrice > 0 && quotePrice > 0, "ChainlinkPriceOracle: NEGATIVE");
require(basePriceAnsweredInRound >= basePriceRoundID && quotePriceAnsweredInRound >= quotePriceRoundID, "ChainlinkPriceOracle: STALE PRICE"); // @audit-info add stale check
require(basePriceTimestamp != 0 && quotePriceTimestamp != 0, "ChainlinkPriceOracle: ROUND INCOMPLETE"); // @audit-info add round incomplete check