GimelSec - latestRoundData could return stale or incorrect result

[sherlock-admin]

GimelSec

medium

latestRoundData could return stale or incorrect result

Summary

USSD uses Chainlink’s price feeds in the stable oracles. But it doesn't contain a check for round completeness which could result in stale or incorrect prices.

Vulnerability Detail

USSD uses priceFeed.latestRoundData() without any check.
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWETH.sol#L23

    function getPriceUSD() external view override returns (uint256) {
        //(uint80 roundID, int256 price, uint256 startedAt, uint256 timeStamp, uint80 answeredInRound) = priceFeed.latestRoundData();
        (, int256 price, , , ) = priceFeed.latestRoundData();
        // chainlink price data is 8 decimals for WETH/USD
        return uint256(price) * 1e10;
    }

Impact

The stale and incorrect price could harm the protocol.

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWETH.sol#L23
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWBTC.sol#L23
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleDAI.sol#L48

Tool used

Manual Review

Recommendation

Add a check to prevent stale and incorrect prices.

        (uint80 roundId, int256 price, , uint256 updatedAt, uint80 answeredInRound) = oracle.latestRoundData();

        require(updatedAt > 0, "Round is not complete");
        require(price >= 0, "Malfunction");
        require(answeredInRound >= roundID, "Stale price");

Duplicate of #31