xiaoming90 - Oracle's validation checks can be further strengthened

[github-actions]

xiaoming90

medium

Oracle's validation checks can be further strengthened

Summary

Validation checks of the oracle can be further strengthened.

Vulnerability Detail

Following is the existing validation check in place for the returned oracle price.

https://github.com/sherlock-audit/2024-04-alchemix/blob/main/v2-foundry/src/utils/collectors/OptimismRewardCollector.sol#L78

File: OptimismRewardCollector.sol
091:     function getExpectedExchange(address yieldToken) external view returns (uint256) {
092:         uint256 expectedExchange;
093:         address[] memory token = new address[](1);
094:         uint256 totalToSwap = TokenUtils.safeBalanceOf(rewardToken, address(this));
095: 
096:         // Ensure that round is complete, otherwise price is stale.
097:         (
098:             uint80 roundID,
099:             int256 opToUsd,
100:             ,
101:             uint256 updateTime,
102:             uint80 answeredInRound
103:         ) = IChainlinkOracle(opToUsdOracle).latestRoundData();
104:         
105:         require(
106:             opToUsd > 0, 
107:             "Chainlink Malfunction"
108:         );
109: 
110:         if( updateTime < block.timestamp - 1200 seconds ) {
111:             revert("Chainlink Malfunction");
112:         }

It was observed that the validation checks can be further strengthened. Refer to the recommendation for more details.

Impact

Oracle price returned might be incorrect under certain conditions.

Code Snippet

https://github.com/sherlock-audit/2024-04-alchemix/blob/main/v2-foundry/src/utils/collectors/OptimismRewardCollector.sol#L78

Tool used

Manual Review

Recommendation

Consider implementing the following check against the returned oracle price.

if (
    roundID == 0 || opToUsd <= 0 || updateTime == 0 || updateTime > block.timestamp
        || updateTime < block.timestamp - 1200
) revert InvalidDataReturned();

The L2 Sequencer Uptime Feeds were also not utilized to check the status of the L2 sequencer in the price oracle. Consider integrating it into the oracle if necessary.

Duplicate of #14