Missing check for delayed oracle price

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/Controller.sol#L288-L309

Vulnerability details

Impact

Missing check for delayed oracle price. If oracle bug by not starting next round (answeredInRound >= roundID but timeStamp is 1 hour to the past), the oracle returns a stale price.

Proof of Concept

        AggregatorV3Interface priceFeed = AggregatorV3Interface(
            vaultFactory.tokenToOracle(_token)
        );
        (
            uint80 roundID,
            int256 price,
            ,
            uint256 timeStamp,
            uint80 answeredInRound
        ) = priceFeed.latestRoundData();

        uint256 decimals = 10**(18-(priceFeed.decimals()));
        price = price * int256(decimals);

        if(price <= 0)
            revert OraclePriceZero();

        if(answeredInRound < roundID)
            revert RoundIDOutdated();

        if(timeStamp == 0)
            revert TimestampZero();

Not checked for block.timestamp <= updatedAt + stalePriceDelay -> a stale price case

Tools Used

Manual review

Recommended Mitigation Steps

Add block.timestamp <= updatedAt + stalePriceDelay check. Where stalePriceDelay is a constant

unit constant stalePriceDelay = 10 minutes;
...
        AggregatorV3Interface priceFeed = AggregatorV3Interface(
            vaultFactory.tokenToOracle(_token)
        );
        (
            uint80 roundID,
            int256 price,
            ,
            uint256 timeStamp,
            uint80 answeredInRound
        ) = priceFeed.latestRoundData();

        uint256 decimals = 10**(18-(priceFeed.decimals()));
        price = price * int256(decimals);

        if(price <= 0)
            revert OraclePriceZero();

        if(answeredInRound < roundID)
            revert RoundIDOutdated();

        if(timeStamp == 0)
            revert TimestampZero();

        if(block.timestamp > updatedAt + stalePriceDelay)
            revert TimestampStale();
...

[HickupHH3]

dup #61