QA Report

[code423n4]

Oracle returns Chainlink latestRoundData without proper validation

Lines of code

https://github.com/code-423n4/2022-06-connext/blob/main/contracts/contracts/core/connext/helpers/ConnextPriceOracle.sol#L122

Vulnerability details

Impact

Oracle returns Chainlink latestRoundData without proper validation.

Issue

In getPriceFromChainlink function at ConnextPriceOracle.sol#L122, there is no check to see if returned price of aggregator.latestRoundData() is not stale. More details at https://docs.chain.link/docs/faq/#how-can-i-check-if-the-answer-to-a-round-is-being-carried-over-from-a-previous-round

Recommended Mitigation Steps

Modify the function as below:

(uint80 round, int256 latestPrice, , uint256 latestTimestamp, uint80 answeredInRound) = aggregator.latestRoundData();
require(feedPrice > 0, "Chainlink price <= 0");
require(answeredInRound >= round, "Stale price");
require(latestTimestamp != 0, "Round not complete");

[ecmendenhall]

Duplicate of #190

[jakekidd]

dup #190