Chainlink price data could be stale

[code423n4]

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2021-10-mochi/blob/8458209a52565875d8b2cefcb611c477cefb9253/projects/mochi-cssr/contracts/adapter/ChainlinkAdapter.sol#L43-L65

function getPrice(address _asset)
        public
        view
        override
        returns (float memory)
    {
        (, int256 price, , , ) = feed[_asset].latestRoundData();
        uint256 decimalSum = feed[_asset].decimals() +
            IERC20Metadata(_asset).decimals();
        if (decimalSum > 18) {
            return
                float({
                    numerator: uint256(price),
                    denominator: 10**(decimalSum - 18)
                });
        } else {
            return
                float({
                    numerator: uint256(price) * 10**(18 - decimalSum),
                    denominator: 1
                });
        }
    }

On ChainlinkAdapter.sol, we are using latestRoundData, but there is no check if the return value indicates stale data. This could lead to stale prices according to the Chainlink documentation:

• https://docs.chain.link/docs/historical-price-data/#historical-rounds
• https://docs.chain.link/docs/faq/#how-can-i-check-if-the-answer-to-a-round-is-being-carried-over-from-a-previous-round

Recommendation

Consider adding missing checks for stale data.

For example:

(uint80 roundID, int256 price, , uint256 timeStamp, uint80 answeredInRound) = feed[_asset].latestRoundData();
require(price > 0, "Chainlink price <= 0"); 
require(answeredInRound >= roundID, "Stale price");
require(timeStamp != 0, "Round not complete");

[r2moon]

duplicated with #87