Insufficient validation of price oracle data

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-11-kelp/blob/main/src/oracles/ChainlinkPriceOracle.sol#L38

Vulnerability details

Impact

The function ChainlinkPriceOracle.getAssetPrice uses the Chainlink aggregation's deprecated getLatestAnswer function to retrieve data. This issue was raised as low severity in the Bot Report, but neither the impact nor the mitigation was elaborated on. Similar issues have been raised as medium severity in previous Code4rena contests.

The latestAnswer function returns the most recent data for the query with no indication of when it was last updated. This could lead to stale values being used, which could impact the accuracy of calculations dependent on the prices returned by the oracle.

Proof of Concept

• Chainlink Docs: latestAnswer
• Chainlink Docs: latestRoundData

Tools Used

Manual review.

Recommended Mitigation Steps

latestRoundData should be used instead of latestAnswer. The updatedAt return value should be validated to be within a reasonable window of block.timestamp. Appropriate fallback functionality should be introduced, such as a secondary oracle to query should the primary oracle return a stale value.

Assessed type

Oracle

[c4-pre-sort]

raymondfam marked the issue as duplicate of #34

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-pre-sort]

raymondfam marked the issue as not a duplicate

[c4-pre-sort]

raymondfam marked the issue as duplicate of #843

[c4-judge]

fatherGoose1 marked the issue as unsatisfactory:
Invalid