lemonmon - ControllerPeggedAssetV2 token price can be influenced by stale oracle price

[sherlock-admin]

lemonmon

medium

ControllerPeggedAssetV2 token price can be influenced by stale oracle price

Summary

ControllerPeggedAssetV2.getLatestPrice is missing some checks for stale oracle price.

Vulnerability Detail

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Controllers/ControllerPeggedAssetV2.sol#L299-L315

After the function latestRoundData is called (ControllerPeggedAssetV2.sol line 300), some checks for staleness are missing:

There is no check for an invalid roundID.

There is also no check for an invalid timestamp (updatedAt). According to the Chainlink docs, it is recommended to:

Your application should track the latestTimestamp variable or use the updatedAt value from the latestRoundData() function to make sure that the latest answer is recent enough for your application to use it. If your application detects that the reported answer is not updated within the heartbeat or within time limits that you determine are acceptable for your application, pause operation or switch to an alternate operation mode while identifying the cause of the delay.

During periods of low volatility, the heartbeat triggers updates to the latest answer. Some heartbeats are configured to last several hours, so your application should check the timestamp and verify that the latest answer is recent enough for your application.

https://docs.chain.link/data-feeds/#check-the-timestamp-of-the-latest-answer

Impact

The Y2K protocol is sensitive to the token price to function properly. Therefore it is important to use fresh token prices from the oracle. In the time of volatility, it may happen that the oracle fails to agree on the price, returning stale price information. If the stale price information is used, the protocol can function in unexpected ways.

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Controllers/ControllerPeggedAssetV2.sol#L299-L315

Tool used

Manual Review

Recommendation

Chainlink doc suggests comparing the updatedAt return against the current timestamp and check if the difference between them is within an admissible deviation.

require(roundID > 0, "Invalid roundID");
require(block.timestamp - updatedAt < SECONDS_PER_HOUR); // Check for freshness of feed
require(updatedAt != 0, "Incomplete round");

Duplicate of #70