getPriceFromChainlink IS NOT INSUFFICIENTLY VALIDATED

[code423n4]

Lines of code

https://github.com/code-423n4/2022-06-connext/blob/main/contracts/contracts/core/connext/helpers/ConnextPriceOracle.sol#:~:text=%7D-,function%20getPriceFromChainlink(address%20_tokenAddress)%20public%20view%20returns%20(uint256,%7D,-return%200%3B

Vulnerability details

Impact

Oracle data feed is insufficiently validated. There no check for stale price. Price can be stale and lead to wrong answer that will return the wrong price

Proof of Concept

ContextPriceOracle.sol L#125

There's no checks for stale price.

Tools Used

Manuel Review

Recommended Mitigation Steps

You can use validation like:
require( answer >= 0, "Stale price");

[ecmendenhall]

Duplicate of #190

[jakekidd]

dup #190

[0xleastwood]

Merging with #76.