ni8mare - Chainlink Oracle return values are not being checked.

[sherlock-admin]

ni8mare

medium

Chainlink Oracle return values are not being checked.

Summary

Chainlink Oracle return values are not handled properly.

Vulnerability Detail

The chainlink priceFeed.latestRoundData() returns other values (like roundId, updatedAt, answeredInRound) apart from price that need to be checked. Otherwise, we could get stale prices or incomplete rounds.

Impact

If there is a problem with Chainlink starting a new round and finding consensus on the new value for the oracle, consumers of the oracle contract may continue using outdated data.

Code Snippet

This is seen in the following contacts:

StableOracleDai
StableOracleWBTC
StableOracleWETH

Tool used

Manual Review

Recommendation

It is recommended to add the following checks:

require(price > 0, "Invalid price");
require(answeredInRound >= roundID , "Stale price");
require(timestamp != 0, "Round not complete");

Duplicate of #31