Age of chainlink feed response not validated

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/bca5080635370424a9fe21fe1aded98345d1f723/src/Controller.sol#L295

Vulnerability details

Impact

Controller only checks that timeStamp is not equal to 0. However, the actual age of the response is not validated.

Proof Of Concept

When the feed returns a very old price, a depeg event can be triggered, although it did not happen during the insurance timespan. For instance, if the feed would return a response that is 1 day old for a freshly started vault, a depeg could be initiated, although the peg might have recovered and was never below the threshold in the insurance timespan.

Recommended Mitigation Steps

All responses that are older than the epoch begin of the queried epoch should be discarded, because any depeg that happened before the epoch begin is not insured.

[HickupHH3]

dup #61