Chainlink's latestRoundData might return stale or incorrect results

[code423n4]

Lines of code

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairHelper.sol#L125-L149
https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairCore.sol#L516-L547

Vulnerability details

Impact

Stale data from an oracle will lead to incorrect exchange rates.

Proof of Concept

In FraxlendPairHelper and FraxlendPairCore we are using latestRoundData() to retrieve exchange rate data from a Chainlink oracle but there is no check to ensure that the return value is not stale data. A problem with the oracle (consensus failure, network congestion, etc) could lead to stale return values which would create an incorrect exchange rate.

References:

• https://consensys.net/diligence/audits/2021/09/fei-protocol-v2-phase-1/#chainlinkoraclewrapper---latestrounddata-might-return-stale-results
• Chainlink's latestRoundData might return stale or incorrect results 2021-10-mochi-findings#87
• Chainlink's latestRoundData might return stale or incorrect results 2021-12-perennial-findings#24
• https://docs.chain.link/docs/historical-price-data/#getrounddata-return-values

Tools Used

Vscode

Recommended Mitigation Steps

Consider adding the following checks:

...
( uint80 roundId, int256 _answer, , uint256 updatedAt, uint80 answeredInRound ) = AggregatorV3Interface(XXXXX).latestRoundData();
require(_answer > 0, "Chainlink price <= 0");
require(updatedAt != 0, "Incomplete round");
require(answeredInRound >= roundId, "Stale price");
...

[amirnader-ghazvini]

Duplicate of #179