Inverse Finance contest - tonisives's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol/#L82 https://github.com/code-423n4/2022-10-inverse/blob/main/src/Oracle.sol/#L116

Vulnerability details

The contracts use Chainlink’s deprecated API latestAnswer(). This function might suddenly stop working if Chainlink stopped supporting deprecated APIs.

Deprecation: https://docs.chain.link/docs/data-feeds/price-feeds/api-reference/#latestanswer

Impact

Deprecated API stops working. Prices cannot be obtained. Protocol stops and contracts have to be redeployed.

Recommended Mitigation Steps

Use V3 interface functions: https://docs.chain.link/docs/price-feeds-api-reference/ with latestRoundData

When using that function, you can also check for stale data

(uint80 roundID, int256 answer, , uint256 timestamp, uint80 answeredInRound) = _ethOracle.latestRoundData();
require(answeredInRound >= roundID, "Stale price");
require(timestamp != 0,"Round not complete");
require(answer > 0,"Chainlink answer reporting 0");

Here you could also check the answer’s timestamp, to verify it is actually for today, and not stale data. Then you can set the correct daily low.

dailyLows[token][day] = normalizedPrice

https://docs.chain.link/docs/data-feeds/price-feeds/historical-data/#historical-rounds