peanuts - Chainlink oracle's price check may be insufficient validated

[sherlock-admin]

peanuts

medium

Chainlink oracle's price check may be insufficient validated

Summary

Chainlink oracle's price check may be insufficient.

Vulnerability Detail

The function getLatestPrice in ControllerPeggedAssetV2.sol checks for round completeness and price, but does not check for staleness of price. (uint256 updatedAt variable)

        (uint80 roundID, int256 price, , , uint80 answeredInRound) = priceFeed
            .latestRoundData();
        uint256 decimals = priceFeed.decimals();

...
...

        if (price <= 0) revert OraclePriceZero();


        if (answeredInRound < roundID) revert RoundIDOutdated();


        return price;

The above checks for the staleness of the sequencer, not the staleness of price.

/// @--audit this checks for the staleness of the sequencer
        uint256 timeSinceUp = block.timestamp - startedAt;
        if (timeSinceUp <= GRACE_PERIOD_TIME) {
            revert GracePeriodNotOver();
        }

Impact

Oracle may return a stale price.

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Controllers/ControllerPeggedAssetV2.sol#L296-L317

Tool used

Manual Review

Recommendation

Recommend checking for the updated price as well

+        (uint80 roundID, int256 price, , uint256 updatedAt, uint80 answeredInRound) = priceFeed
            .latestRoundData();
        uint256 decimals = priceFeed.decimals();

...
...

        if (price <= 0) revert OraclePriceZero();

  
        if (answeredInRound < roundID) revert RoundIDOutdated();

+     if(block.timestamp - updatedAt > GRACE_PERIOD_TIME) revert PriceOutdated();
        return price;

Duplicate of #70