curiousapple - Chainlink's latestRoundData() can return stale or incorrect result

[sherlock-admin]

curiousapple

medium

Chainlink's latestRoundData() can return stale or incorrect result

Summary

Vulnerability Detail

USSD is using Chainlink to fetch prices for multiple collaterals.
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleDAI.sol#L48
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWBTC.sol#L23
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWETH.sol#L23

However, there is no check if the return value indicates stale data.

Impact

This could lead to stale prices according to the Chainlink documentation:
https://docs.chain.link/data-feeds/price-feeds/historical-data
Related report:
code-423n4/2021-05-fairside-findings#70

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleDAI.sol#L48
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWBTC.sol#L23
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWETH.sol#L23

Tool used

Manual Review

Recommendation

Consider reverting in case of stale prices, you can do so using the "updatedAt" return from the call of latestRoundData

Duplicate of #31