Chainlink's latestRoundData might return stale price in FraxlendPairCore.sol

[code423n4]

Lines of code

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairCore.sol#L524
https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairCore.sol#L532

Vulnerability details

Proof of Concept

(, int256 _answer, , , ) = AggregatorV3Interface(oracleMultiply).latestRoundData();
            if (_answer <= 0) {
                revert OracleLTEZero(oracleMultiply);
     }

When calling latestRoundData the code does check if the price is not less than or equal to zero, but it doesn’t check if the round is incomplete or the price is stale. The issue is for both oracleMultiply and oracleDivide.

Impact

The exchangeRate is a core part of the protocol and using a stale price can result in the protocol not allowing a liquidator to liquidate a position yet, even though the price is crashing and a borrower is insolvent, which will result in a loss of capital.

Recommendation

Change the latestRoundData logic to the following (you can use custom errors instead require statements as well):

(roundId, rawPrice,, updatedAt, answeredInRound) = AggregatorV3Interface(oracleMultiply).latestRoundData()
require(rawPrice > 0, "Chainlink price <= 0");
require(updatedAt != 0, "Incomplete round");
require(answeredInRound >= roundId, "Stale price");

Change the code exactly the same way for the oracleDivide latestRoundData() call.

[amirnader-ghazvini]

Duplicate of #179