Inverse Finance contest - cuteboiz's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol#L82

Vulnerability details

Impact

Oracle.sol is calling latestAnswer to get the price. This method will return the last value, but you won’t be able to check if the data is fresh. On the other hand, calling the method latestRoundData allow you to run some extra validations.

According to Chainlink’s documentation (https://docs.chain.link/docs/price-feeds-api-reference/) the function latestAnswer has been deprecated, This function does not throw an error if no answer has been reached, but instead returns 0, causing an incorrect price to be fed.

Proof of Concept

• https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol#L82

// get price from feed
            uint price = feeds[token].feed.latestAnswer();
            require(price > 0, "Invalid feed price");

Tools Used

Manually

Recommended Mitigation Steps

Recommend using the latestRoundData function to get the price instead. Also recommend adding checks on the return data with proper revert messages if the price is stale or the round is incomplete, for example: