Inverse Finance contest - rokinot's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol#L82 https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol#L116

Vulnerability details

Impact

Oracle may stop working in the future.

Proof of Concept

As per Chainlink docs, latestAnswer() is deprecated and in the future may not be supported anymore, ceasing to function. Reference for the documentation in the link below: https://docs.chain.link/docs/data-feeds/price-feeds/api-reference/

Tools Used

Manual code reading

Recommended Mitigation Steps

Use latestRoundData() instead, which returns the following variables

    uint80 roundId,
    int256 answer,
    uint256 startedAt,
    uint256 updatedAt,
    uint80 answeredInRound

Modify the line to the following:

(,int256 price, , ,) = feeds[token].feed.latestRoundData();