w42d3n - Chainlink’s latestRoundData might return stale or incorrect results

[sherlock-admin]

w42d3n

medium

Chainlink’s latestRoundData might return stale or incorrect results

Summary

The contract WSTETHOracle.sol calls out to a Chainlink oracle receiving the latestRoundData().

Vulnerability Detail

If there is a problem with Chainlink starting a new round and finding consensus on the new value for the oracle (e.g. Chainlink nodes abandon the oracle, chain congestion, vulnerability/attacks on the chainlink system) consumers of this contract may continue using outdated stale or incorrect data (if oracles are unable to submit no new round is started).

Impact

Stale prices that do not reflect the current market price anymore could be used which would influence the membership and cost share pricing.

References

• https://docs.chain.link/docs/data-feeds/price-feeds/historical-data/#getrounddata-return-values
• https://consensys.net/diligence/audits/2021/09/fei-protocol-v2-phase-1/#chainlinkoraclewrapper-latestrounddata-might-return-stale-results
• Should check return data from Chainlink aggregators code-423n4/2021-05-fairside-findings#70

Code Snippet

src/wsteth/WSTETHOracle.sol

L47-48:

(, int answer,, uint updatedAt,) =
        WSTETHFeed.latestRoundData();

Tool used

Manual Review

Recommendation

Recommend adding the following checks:

(, int answer,, uint updatedAt,) =
        WSTETHFeed.latestRoundData();

require(updatedAt != 0, "Incomplete round");
require(answer >= 0, "Stale price");

[w42d3n]

Escalate for 1 USDC:
My finding was labelled Medium by 'sherlock-admin' (not by a bot) and is certainly valid.
It might have also a severe impact for the protocol and I think it should deserve a reward.

[sherlock-admin]

Escalate for 1 USDC:
My finding was labelled Medium by 'sherlock-admin' (not by a bot) and is certainly valid.
It might have also a severe impact for the protocol and I think it should deserve a reward.

You've created a valid escalation for 1 USDC!

To remove the escalation from consideration: Delete your comment.
To change the amount you've staked on this escalation: Edit your comment (do not create a new comment).

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

[Evert0x]

Escalation rejected

A freshness and incorrect check is already present https://github.com/sherlock-audit/2022-11-sentiment/blob/main/oracle-merged/src/wsteth/WSTETHOracle.sol#L50-L54

[sherlock-admin]

Escalation rejected

A freshness and incorrect check is already present https://github.com/sherlock-audit/2022-11-sentiment/blob/main/oracle-merged/src/wsteth/WSTETHOracle.sol#L50-L54

This issue's escalations have been rejected!

Contestants' payouts and scores will not be updated.

Auditors who escalated this issue will have their escalation amount deducted from future payouts.