vagrant - getPriceUSD() might return stale price

[sherlock-admin]

vagrant

medium

getPriceUSD() might return stale price

Summary

latestRoundData() might return stale price

Vulnerability Detail

All oracles use latestRoundData, but there is no check if the return value indicates stale data.

Impact

Users may mint wrong amount of USSD, rebalance might not work as intended

Code Snippet

https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWBGL.sol#L24
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWBTC.sol#L21
https://github.com/sherlock-audit/2023-05-USSD/blob/main/ussd-contracts/contracts/oracles/StableOracleWETH.sol#L21

    function getPriceUSD() external view override returns (uint256) {
        //(uint80 roundID, int256 price, uint256 startedAt, uint256 timeStamp, uint80 answeredInRound) = priceFeed.latestRoundData();
        (, int256 price, , , ) = priceFeed.latestRoundData();
        // chainlink price data is 8 decimals for WETH/USD
        return uint256(price) * 1e10;
    }

Tool used

Manual Review

Recommendation

add a check that checks whether the price from latestRoundData is stale or not

Duplicate of #31