Improper Validation Of Chainlink's latestRoundData() Function

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/Oracle.sol#L33
https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/Oracle.sol#L115

Vulnerability details

Impact

The calls to the latestRoundData() function do not validate the output of the Chainlink oracle query. As a result, it is possible to use stale results when returning the TWAP price. latestRoundData() is able to ensure the round is complete and has returned a valid/expected price by validating additional round data. This is documented here. However, there are some missing validations that can be improve upon the existing implementation.

Proof of Concept

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/Oracle.sol#L33
https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/Oracle.sol#L115

Tools Used

Manual code review.
Chainlink best practices.

Recommended Mitigation Steps

Consider performing proper validation of Chainlink's latestRoundData() function. This can be updated or adapted to match the following code snippet:

(
uint80 roundID,
int256 oraclePrice,
,
uint256 updateTime,
uint80 answeredInRound
) = AggregatorV2V3Interface(priceOracle).latestRoundData();
require(
answeredInRound >= roundID,
"Hubble: Chainlink Price Stale"
);
require(oraclePrice > 0, "Hubble: Chainlink Malfunction");
require(updateTime != 0, "Hubble: Incomplete round");

[atvanguard]

Duplicate of #46