Outdated oracle price

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-11-kelp/blob/main/src/oracles/ChainlinkPriceOracle.sol#L37-L39

Vulnerability details

Impact

Oracle's price might be non actual, and might lead to wrong asset prices. And wrong asset prices will lead to wrong amount of rsETH to mint.

Proof of Concept

Let's consider this function:

    function getAssetPrice(address asset) external view onlySupportedAsset(asset) returns (uint256) {
        return AggregatorInterface(assetPriceFeed[asset]).latestAnswer();
    }

This function extracts price from ChainLink.

• At the first latestAnswer is deprecated.
• At the second price can be updated a long time ago, and at moment of requesting it can be non actual.
  Current implementation doesn't check this case. And it's possible to get outdated price.

So, solution here is use latestRoundData. But additionally check response startedAt value. If it's too old (for example more than 5 minutes), then revert execution.

Tools Used

Manual review

Recommended Mitigation Steps

Additionally, when returns price, checks that price is actual.

Assessed type

Oracle

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #32

[c4-pre-sort]

raymondfam marked the issue as not a duplicate

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #34

[c4-judge]

fatherGoose1 marked the issue as unsatisfactory:
Invalid