Brenzee - Chainlink's latestRoundData might be stale or incorrect

[sherlock-admin]

Brenzee

medium

Chainlink's latestRoundData might be stale or incorrect

Summary

Returned data from latestRoundData is not checked if it is valid and not stale.

Vulnerability Detail

Here is an example of StableOracleWETH.sol contract

    function getPriceUSD() external view override returns (uint256) {
        //(uint80 roundID, int256 price, uint256 startedAt, uint256 timeStamp, uint80 answeredInRound) = priceFeed.latestRoundData();
        (, int256 price, , , ) = priceFeed.latestRoundData();
        // chainlink price data is 8 decimals for WETH/USD
        return uint256(price) * 1e10;
    }

As we can see latestRoundData returned values are not being verified.

Impact

This could lead to stale/incorrect prices according to Chainlink https://docs.chain.link/data-feeds/price-feeds/historical-data

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleDAI.sol#L48
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWBTC.sol#L23
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWETH.sol#L23

Tool used

Manual Review

Recommendation

Add check statements, that verify if data is valid and not stale.
Example for StableOracleWETH.sol

    function getPriceUSD() external view override returns (uint256) {
        //(uint80 roundID, int256 price, uint256 startedAt, uint256 timeStamp, uint80 answeredInRound) = priceFeed.latestRoundData();
        (uint80 roundID, int256 answer, uint256 timestamp, uint256 updatedAt,) = priceFeed.latestRoundData();
        // chainlink price data is 8 decimals for WETH/USD
        require(updatedAt >= roundID, "Stale price");
        require(timestamp != 0,"Round not complete");
        require(answer > 0,"Chainlink answer reporting 0");
        return uint256(price) * 1e10;
    }

Duplicate of #31