priceFeed1 in pegOracle is not checked for sanity

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/oracles/PegOracle.sol#L63

Vulnerability details

Impact

priceFeed1 is called directly, instead of through getOracle1_Price, thus missing assurance checks. for example, price1<=0 is not reverted. This may result in unexpected behavior.

Proof of Concept

https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/oracles/PegOracle.sol#L63

Tools Used

Recommended Mitigation Steps

1. merge getOracle1_Price() and getOracle2_Price() to take in an oracleIndex:
   getOracle_Price(uint256 oracleIndex)
2. let getOracle_Price return other items as well:
   getOracle_Price(uint256 oracleIndex) returns (uint80 roundID, int256 price, uint256 timeStamp, uint80 answeredInRound)
3. apply decimal adjustment inside of this function, so both priceFeeds are adjusted properly.
4. used getOracle_Price(0) and getOracle1_Price(1) to get the correct priceFeeds.

[HickupHH3]

partial credit. the keyword i'm looking for is stale prices. while negative prices are a possibility, it's arguably more unlikely to happen compared to staleness.

[HickupHH3]

dup of #61

[HickupHH3]

realise that the <= 0 check is done in the Factory. Hence, further reducing the partial credit given (not entirely invalidating because of the <= 0 check is arguably better placed in the PegOracle).