bin2chen - getLatestPrice() possible use stale price

[sherlock-admin]

bin2chen

medium

getLatestPrice() possible use stale price

Summary

not check updatedAt, still possible to use stale price

Vulnerability Detail

getLatestPrice:

    function getLatestPrice(address _token) public view returns (int256) {
...
        AggregatorV3Interface priceFeed = AggregatorV3Interface(
            vaultFactory.tokenToOracle(_token)
        );
        (uint80 roundID, int256 price, , , uint80 answeredInRound) = priceFeed
            .latestRoundData();
        uint256 decimals = priceFeed.decimals();

        if (decimals < 18) {
            decimals = 10**(18 - (decimals));
            price = price * int256(decimals);
        } else if (decimals == 18) {
            price = price;
        } else {
            decimals = 10**((decimals - 18));
            price = price / int256(decimals);
        }

        if (price <= 0) revert OraclePriceZero();

        if (answeredInRound < roundID) revert RoundIDOutdated();
        //<-------only check roundID, not check updatedAt
        return price;

Currently, only the answeredInRound is checked and not check updatedAt, still possible to use stale price

Impact

getLatestPrice() may return stale data

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Controllers/ControllerPeggedAssetV2.sol#L273

Tool used

Manual Review

Recommendation

    function getLatestPrice(address _token) public view returns (int256) {
        (
...
-        (uint80 roundID, int256 price, , , uint80 answeredInRound) = priceFeed
            .latestRoundData();
+        (uint80 roundID, int256 price, , updatedAt, uint80 answeredInRound) = priceFeed
            .latestRoundData();


        if (price <= 0) revert OraclePriceZero();

        if (answeredInRound < roundID) revert RoundIDOutdated();

+       if (updatedAt < block.timestamp - MAX_DELAY) {
+           revert();
+       }
        return price;

Duplicate of #70