Yield-Convex contest - cccz's results

Handle

cccz

Vulnerability details

Impact

On Cvx3CrvOracle.sol, we are using latestRoundData, but there is no check if the return value indicates stale data. This could lead to stale prices according to the Chainlink documentation:

https://docs.chain.link/docs/historical-price-data/#historical-rounds https://docs.chain.link/docs/faq/#how-can-i-check-if-the-answer-to-a-round-is-being-carried-over-from-a-previous-round  

    function _peek(
        bytes6 base,
        bytes6 quote,
        uint256 baseAmount
    ) private view returns (uint256 quoteAmount, uint256 updateTime) {
        require(
            (base == ethId && quote == cvx3CrvId) ||
                (base == cvx3CrvId && quote == ethId),
            "Invalid quote or base"
        );
        (, int256 daiPrice, , , ) = DAI.latestRoundData();
        (, int256 usdcPrice, , , ) = USDC.latestRoundData();
        (, int256 usdtPrice, , , ) = USDT.latestRoundData();

        require(
            daiPrice > 0 && usdcPrice > 0 && usdtPrice > 0,
            "Chainlink pricefeed reporting 0"
        );

Proof of Concept

https://github.com/code-423n4/2022-01-yield/blob/main/contracts/Cvx3CrvOracle.sol#L110-L128

Tools Used

None

Recommended Mitigation Steps

Consider adding missing checks for stale data.

For example:

    function _peek(
        bytes6 base,
        bytes6 quote,
        uint256 baseAmount
    ) private view returns (uint256 quoteAmount, uint256 updateTime) {
        require(
            (base == ethId && quote == cvx3CrvId) ||
                (base == cvx3CrvId && quote == ethId),
            "Invalid quote or base"
        );
        (uint80 DAIroundID, int256 DAIfeedPrice, , uint256 DAItimestamp, uint80 DAIansweredInRound) = DAI.latestRoundData();
        (uint80 USDCroundID, int256 USDCfeedPrice, , uint256 USDCtimestamp, uint80 USDCansweredInRound) = USDC.latestRoundData();
        (uint80 USDTroundID, int256 USDTfeedPrice, , uint256 USDTtimestamp, uint80 USDTansweredInRound) = USDT.latestRoundData();
        require(DAIansweredInRound >= DAIroundID && USDCansweredInRound >= USDCroundID && USDTansweredInRound >= USDTroundID , "Stale price");
        require(DAItimestamp != 0 && USDCtimestamp != 0 && USDTtimestamp != 0, "Round not complete");
        require(
            DAIfeedPrice > 0 && USDCfeedPrice > 0 && USDTfeedPrice > 0,
            "Chainlink pricefeed reporting 0"
        );