Oracle price could not be fresh

[code423n4]

Lines of code

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairCore.sol#L524
https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairCore.sol#L532

Vulnerability details

Vulnerability

In FraxlendPairCore._updateExchangeRate, we are using latestRoundData, but there are no validations that the data is not stale.

The current code is:

           (, int256 _answer, , , ) = AggregatorV3Interface(oracleMultiply).latestRoundData();
            if (_answer <= 0) {
                revert OracleLTEZero(oracleMultiply);
            }

But is missing the checks to validate the data is stale:

-           (, int256 _answer, , , ) = AggregatorV3Interface(oracleMultiply).latestRoundData();
+           (uint80 round, int256 _answer, , uint256 latestTimestamp, answeredInRound) = AggregatorV3Interface(oracleMultiply).latestRoundData();
            if (_answer <= 0) {
                revert OracleLTEZero(oracleMultiply);
            }
+           require(latestTimestamp != 0, "Incomplete round");
+           require(answeredInRound >= round, "Stale price");

Note that an inaccurate price data could quickly lead to a large loss of funds.

[0xA5DF]

Out of scope, similar to #361

[DrakeEvans]

Stale oracle data, and bad oracle data in general is an accepted risk of the project. It is listed in known issues as well. Out of scope

[gititGoro]

Oracle misconfiguration is listed as a known issue in the README and is out of scope. Presumably Frax has some infrastructure in mind to handle this.

Marking invalid.