Lack of checks on Staleness of Chainlink data

[code423n4]

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/oracles/PegOracle.sol#L58-L63
https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/Controller.sol#L308-L309
https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/oracles/PegOracle.sol#L103

Vulnerability details

Impact

In PegOracle.latestRoundData(), when priceFeed1.latestRoundData() is called there are no checks whether the data is stale or not. This could lead to the oracle reporting incorrect prices which can negatively affect hedge and risk users, e.g. the oracle reports a price of 1.0 even if a depeg has occurred.

Additionally, even though all other sections of code which use oracles do check that answeredInRound >= round, it may be the case that the chain link nodes have stopped working and therefore not updated to a new round in a very long time causing the data to be stale.

Tools Used

VS Code

Recommended Mitigation Steps

Add checks for staleness of data including checking the timestamp of the data e.g.

            uint80 roundID1,
            int256 price1,
            ,
            uint256 timeStamp1,
            uint80 answeredInRound1
        ) = priceFeed1.latestRoundData();


        require(price1 > 0, "Chainlink price <= 0");
        require(
            answeredInRound1 >= roundID1,
            "RoundID from Oracle is outdated!"
        );
        //@audit make sure that the timestamp is not from too long ago
        require(timeStamp1 > block.timestamp - OracleWindow, "Timestamp is too low");

[HickupHH3]

dup of #61