ConnextPriceOracle doesn't validate Chainlink data

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-connext/blob/main/contracts/contracts/core/connext/helpers/ConnextPriceOracle.sol#L125

Vulnerability details

Impact

Consumers of a Chainlink price feed should always verify that the price they receive is fresh, i.e. submitted recently. Otherwise, your protocol might work with outdated price data resulting in arbitrage opportunities for attackers.

In the recent incident with Luna/UST, we've seen a protocol that doesn't verify the Chainlink data resulting in them losing ~$11M: https://medium.com/@blizzfinance/blizz-finance-post-mortem-2425a33fe28b

Proof of Concept

The contract only retrieves the price and ignores all the other values:

(, int256 price, , , ) = oracle.latestRoundData();

Tools Used

none

Recommended Mitigation Steps

Verify that the data is fresh by checking the updatedAt parameter: https://docs.chain.link/docs/price-feeds-api-reference/#latestrounddata

Also, Chainlink recommends consumers to be able to pause usage of a specific feed in case the feed is paused: https://docs.chain.link/docs/selecting-data-feeds/#risk-mitigation

[ecmendenhall]

Duplicate of #190

[jakekidd]

dup #190

[0xleastwood]

Merging with #106.