Oracle price could not be fresh in ChainlinkInceptionPriceFeed

[code423n4]

Lines of code

https://github.com/code-423n4/2022-04-mimo/blob/b18670f44d595483df2c0f76d1c57a7bfbfbc083/core/contracts/inception/priceFeed/ChainlinkInceptionPriceFeed.sol#L74-L78

Vulnerability details

Vulnerability

On ChainlinkInceptionPriceFeed, we are using latestRoundData, but there are no validations that the data is not stale.

The current code is:

    (, int256 eurAnswer, , uint256 eurUpdatedAt, ) = _eurOracle.latestRoundData();
    require(eurAnswer > 0, "EUR price data not valid");
    require(block.timestamp - eurUpdatedAt < _PRICE_ORACLE_STALE_THRESHOLD, "EUR price data is stale");

    (, int256 answer, , uint256 assetUpdatedAt, ) = _assetOracle.latestRoundData();
    require(answer > 0, "Price data not valid");
    require(block.timestamp - assetUpdatedAt < _PRICE_ORACLE_STALE_THRESHOLD, "Price data is stale");

But is missing the checks to validate the data is stale

(uint80 roundA, int256 eurAnswer, , uint256 eurUpdatedAt, uint80 answeredInRoundA) = _eurOracle.latestRoundData();
require(eurAnswer > 0, "EUR price data not valid");
require(block.timestamp - eurUpdatedAt < _PRICE_ORACLE_STALE_THRESHOLD, "EUR price data is stale");

require(answeredInRoundA >= roundA, "Stale price");   // <- EXTRA CHECK

This could affect in all the logic, including funds.

Recommendation

Check the round and answeredInRound return.

[Xuefeng-Zhu]

duplicate with #1