Stader Labs - erictee's results

Lines of code

https://github.com/code-423n4/2023-06-stader/blob/main/contracts/StaderOracle.sol#L646-L650

Vulnerability details

Proof of Concept

https://github.com/code-423n4/2023-06-stader/blob/main/contracts/StaderOracle.sol#L646-L650

On StaderOracle.sol, we are using latestRoundData, but there is no check if the return value indicates stale data.

(, int256 totalETHBalanceInInt, , , ) = AggregatorV3Interface(staderConfig.getETHBalancePORFeedProxy()) 
            .latestRoundData();
        (, int256 totalETHXSupplyInInt, , , ) = AggregatorV3Interface(staderConfig.getETHXSupplyPORFeedProxy())
            .latestRoundData();

This could lead to stale prices according to the Chainlink documentation:

https://docs.chain.link/docs/historical-price-data/#historical-rounds
https://docs.chain.link/docs/faq/#how-can-i-check-if-the-answer-to-a-round-is-being-carried-over-from-a-previous-round

Recommended Mitigation Steps

Consider adding missing checks for stale data.

For example:

(uint80 ETHRoundID, int256 totalETHBalanceInInt, , uint256 ETHTimestamp, uint80 ETHAnsweredInRound) = AggregatorV3Interface(staderConfig.getETHBalancePORFeedProxy()).latestRoundData();    
(uint80 ETHXRoundID, int256 totalETHXSupplyInInt, , uint256 ETHXTimestamp, uint80 ETHXAnsweredInRound) = AggregatorV3Interface(staderConfig.getETHXSupplyPORFeedProxy()).latestRoundData(); 
   
require(ETHAnsweredInRound >= ETHRoundID && ETHXAnsweredInRound >=  ETHXRoundID, "Stale price");  
  
require(ETHTimestamp != 0 && ETHXTimestamp != 0 ,"Round not complete");    

require(totalETHBalanceInInt > 0 && totalETHXSupplyInInt > 0,"Chainlink answer reporting 0");

Assessed type

Oracle