ShadowForce - Lack of validation for chainlink price feed timestamp allows outdated price to be used.

[sherlock-admin]

ShadowForce

medium

Lack of validation for chainlink price feed timestamp allows outdated price to be used.

Summary

Lack of validation for chainlink price feed timestamp allows outdated price to be used.

Vulnerability Detail

in the getLatestPrice function latestRoundData calls to an oracle. The problem with the function is that it does not validate that the chainlink pricefeed timestamp is up to date. You can observe this issue by looking at the snippet below.

  AggregatorV3Interface priceFeed = AggregatorV3Interface(
            vaultFactory.tokenToOracle(_token)
        );
        (uint80 roundID, int256 price, , , uint80 answeredInRound) = priceFeed
            .latestRoundData();
        uint256 decimals = priceFeed.decimals();

        if (decimals < 18) {
            decimals = 10**(18 - (decimals));
            price = price * int256(decimals);
        } else if (decimals == 18) {
            price = price;
        } else {
            decimals = 10**((decimals - 18));
            price = price / int256(decimals);
        }

        if (price <= 0) revert OraclePriceZero();

        if (answeredInRound < roundID) revert RoundIDOutdated();

        return price;
    }

As you can see the logic never validates that the chainlink timestamp is up to date and fresh, this in turn allows outdated prices from the chainlink price oracle to be used in the project.

Impact

the epoch can be wrongly settled, when the insurance token depegs, the code does not know it is depegged because of the outdated price oracle,
Insurance buyer (depositor in premium vault) lose their premium and does not get protection from the collateral vault as the protocol stated.
Loss of funds and the functionality of the entire protocol is at risk because of this.

Code Snippet

https://github.com/Y2K-Finance/Earthquake/blob/736b2e1e51bef6daa6a5ecd1decb7d156316d795/src/v2/Controllers/ControllerPeggedAssetV2.sol#L273-L318

Tool used

Manual Review

Recommendation

we recommend to add check to validate the timestamp of the oracle is up to date.

Duplicate of #70