ChainLink Oracle data feed is insufficiently validated.

[code423n4]

Lines of code

https://github.com/code-423n4/2022-08-frax/blob/90f55a9ce4e25bceed3a74290b854341d8de6afa/src/contracts/FraxlendPairCore.sol#L524
https://github.com/code-423n4/2022-08-frax/blob/90f55a9ce4e25bceed3a74290b854341d8de6afa/src/contracts/FraxlendPairCore.sol#L532

Vulnerability details

Impact

Return value of AggregatorV3Interface.latestRoundData() is not properly checked. The price may be stale or the round may be incomplete.

Proof of Concept

FraxlendPairCore.sol

        uint256 _price = uint256(1e36);
        if (oracleMultiply != address(0)) {
            (, int256 _answer, , , ) = AggregatorV3Interface(oracleMultiply).latestRoundData();
            if (_answer <= 0) {
                revert OracleLTEZero(oracleMultiply);
            }
            _price = _price * uint256(_answer);
        }

        if (oracleDivide != address(0)) {
            (, int256 _answer, , , ) = AggregatorV3Interface(oracleDivide).latestRoundData();
            if (_answer <= 0) {
                revert OracleLTEZero(oracleDivide);
            }
            _price = _price / uint256(_answer);
        }

Same as code-423n4/2022-01-yield-findings#136.

Among all return values of latestRoundData, only answer is checked.

Tools Used

Code review.

Recommended Mitigation Steps

Suggest code snippet is like

(uint80 roundID, int256 price, , uint256 timeStamp, uint80 answeredInRound) = oracle.latestRoundData();
require(answeredInRound >= roundID, "...");
require(timeStamp != 0, "...");

[0xA5DF]

Dupe of #10

[amirnader-ghazvini]

Duplicate of #179