Inverse Finance contest - saneryee's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/tree/main/src/Oracle.sol#L6 https://github.com/code-423n4/2022-10-inverse/tree/main/src/Oracle.sol#L82 https://github.com/code-423n4/2022-10-inverse/tree/main/src/Oracle.sol#L116

Vulnerability details

Impact

According to Chainlink's documentation, the latestAnswer function is deprecated. This function does not error if no answer has been reached but returns 0, causing an incorrect price fed. Use the latestRoundData function to get the price instead.

Proof of Concept

interface IChainlinkFeed {
    function decimals() external view returns (uint8);
    function latestAnswer() external view returns (uint);
}

Tools Used

Manual analysis

Recommended Mitigation Steps

Recommend using the latestRoundData function to get the price instead. Also recommend adding checks on the return data with proper revert messages if the price is stale or the round is incomplete, for example:

(uint80 roundID, int256 price, , uint256 timeStamp, uint80 answeredInRound) = oracle.latestRoundData();
require(answeredInRound >= roundID, "...");
require(timeStamp != 0, "...");