T1MOH - Chainlink's latestRoundData return stale or incorrect result

[sherlock-admin]

T1MOH

medium

Chainlink's latestRoundData return stale or incorrect result

Summary

There is no check if the return value of Chainlink indicates stale data.

Vulnerability Detail

In StableOracle contracts you are using latestRoundData, and don't check staleness. For example StableOracleWBTC.sol:

    function getPriceUSD() external view override returns (uint256) {
        //(uint80 roundID, int256 price, uint256 startedAt, uint256 timeStamp, uint80 answeredInRound) = priceFeed.latestRoundData();
        (, int256 price, , , ) = priceFeed.latestRoundData();
        // chainlink price data is 8 decimals for WETH/USD
        return uint256(price) * 1e10;
    }

The same vulnerability in other 2 StableOracle contracts

Impact

It could lead to using wrong prices in USSD.sol

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWBTC.sol#L21-L26
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWETH.sol#L21-L26
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleDAI.sol#L48

Tool used

Manual Review

Recommendation

Add storage variable hearbeat which checks that last answer is not too old. And perform following checks:

        (uint80 roundID, int256 answer, uint256 startedAt, uint256 updatedAt,) = priceFeed.latestRoundData();

        require(updatedAt >= roundID, "Stale price");
        require(startedAt != 0,"Round not complete");
        require(answer > 0,"Chainlink answer reporting 0");
        require(block.timestamp - updatedAt <= heartbeat, "Stale price");

Duplicate of #31