WATCHPUG - Chainlink's latestRoundData might return stale or incorrect results

[sherlock-admin]

WATCHPUG

medium

Chainlink's latestRoundData might return stale or incorrect results

Summary

Vulnerability Detail

On StableOracleWBTC.sol / StableOracleWETH.sol, we are using latestRoundData, but there is no check if the return value indicates stale data. This could lead to stale prices according to the Chainlink documentation:

• https://docs.chain.link/docs/historical-price-data/#historical-rounds
• https://docs.chain.link/docs/faq/#how-can-i-check-if-the-answer-to-a-round-is-being-carried-over-from-a-previous-round

Impact

A stale price can be used for minting USSD.

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWBTC.sol#L21-L26

Tool used

Manual Review

Recommendation

Consider adding missing checks for staleness.

For example:

    function getPriceUSD() external view override returns (uint256) {
        //(uint80 roundID, int256 price, uint256 startedAt, uint256 timeStamp, uint80 answeredInRound) = priceFeed.latestRoundData();
        (, int256 price, uint256 timeStamp, , ) = priceFeed.latestRoundData();
        require(block.timestamp - timeStamp < stalenessTolerance, "stale price");
        // chainlink price data is 8 decimals for WETH/USD
        require(price > 0, "...");
        return uint256(price) * 1e10;
    }

Duplicate of #31