Inverse Finance contest - imare's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L82 https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L116

Vulnerability details

The Chainlink API (latestAnswer) used in the Oracle contract is deprecated:

This API is deprecated. Please see API Reference for the latest Price Feed API. Chainlink Docs (https://docs.chain.link/docs/data-feeds/price-feeds/api-reference/#latestanswer)

Impact

This function might suddenly stop working if Chainlink stop supporting deprecated APIs. And the old API can return stale data.

Proof of Concept

• https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L82
• https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Oracle.sol#L116

Tools Used

Manual review

Recommended Mitigation Steps

Use the latestRoundData function to get the price instead. Add checks on the return data with proper revert messages if the price is stale or the round is uncomplete, for example:

https://docs.chain.link/docs/data-feeds/price-feeds/api-reference/#latestrounddata-1

(uint80 roundID, int256 price, , uint256 timeStamp, uint80 answeredInRound) = feeds[token].feed..latestRoundData();
require(answeredInRound >= roundID, "...");
require(timeStamp != 0, "...");