Chainlink oracle lacks proper validation

[code423n4]

Lines of code

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairCore.sol#L523-L537

Vulnerability details

Impact

Calls to the Chainlink price oracle via latestRoundData() in FraxlendPairCore.sol use the correct function latestRoundData() per Chainlink's documentation, but lack the recommended validations to ensure that the round is complete and does not return stale data.

Per the following Halborn audit, page 19, the recommended implementation is:

(
roundId,
rawPrice,
,
updateTime,
answeredInRound
) = AggregatorV3Interface(XXXXX).latestRoundData();
require(rawPrice > 0 , "Chainlink price <= 0");
require(updateTime != 0 , "Incomplete round");
require(answeredInRound >= roundId , "Stale price");

Halborn audit, page 19:

https://3405344147-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6bWsvjSvuHlmjaYdDGxA%2Fuploads%2FxvaQXQq7NxRcRQBiGL3J%2FRolla_Finance_Quant_Protocol_Smart_Contract_Security_Audit_Report.pdf?alt=media&token=1d59da93-2e5c-4e53-9de8-a4bb6dba138e

Tools Used

Audit report.

Recommended Mitigation Steps

Add checks for stale data, incomplete round, and 0 price return value. If any of these fail, then the function should revert.

Final Note

Though the Frax documentation lists "outdated answers" as a known issue, I believe that extra validations can alleviate such issue.

[0xA5DF]

Duplicate of #10 (at least part of it is out of scope)

[amirnader-ghazvini]

Duplicate of #179