Chainlink oracles might return stale data

[code423n4]

Handle

hack3r-0m

Vulnerability details

Location: https://github.com/code-423n4/2022-01-yield/blob/main/contracts/Cvx3CrvOracle.sol#L120-L122

DAI.latestRoundData returns data from the latest round, but there is no guarantee that the latest round happened frequently, it might be a case where latestRoundData has happened 1 hour or 1 day ago.

This can lead to stale data used for calculation and accounting.

Tools Used

Manual Review

Recommended Mitigation Steps

(
    uint80 roundID, 
    int price,
    uint startedAt,
    uint timeStamp,
    uint80 answeredInRound
) = priceFeed.latestRoundData();

check that startedAt and timestamp are within certain permissible bounds (for e.g difference between current timestamp and latest round timestamp is not more than 1 hour)

[alcueca]

Duplicate of #94

[GalloDaSballo]

Duplicate of #136