latestAnswer doesn't check if the value is up to date

[code423n4]

Handle

pauliax

Vulnerability details

Impact

EIP1271Wallet.sol is calling latestAnswer to get the last price:

uint256 oraclePrice = _toUint(
    AggregatorV2V3Interface(priceOracle).latestAnswer()
);

This method will return the last value, but you won’t be able to check if the data is fresh. On the other hand, calling the method latestRoundData allow you to run some extra validations:

    (
          roundId,
          rawPrice,
          ,
          updateTime,
          answeredInRound
        ) = AggregatorV2V3Interface(priceOracle).latestRoundData();
        require(rawPrice > 0, "Chainlink price <= 0");
        require(updateTime != 0, "Incomplete round");
        require(answeredInRound >= roundId, "Stale price");

See the chainlink documentation for more information: https://docs.chain.link/docs/faq/#how-can-i-check-if-the-answer-to-a-round-is-being-carried-over-from-a-previous-round

Recommended Mitigation Steps

Consider using latestRoundData with validations against stale data.

[jeffywu]

Duplicate of #178

[pauliax]

A duplicate of #197