Chinmay - Chainlink API may return stale prices

[github-actions]

Chinmay

medium

Chainlink API may return stale prices

Summary

When using the latestroundData function to fetch prices from a chainlink price feed/feed registry, it is important to make sure that it returns correct and fresh prices. The answer that is returned may be carried over from the previous round

Vulnerability Detail

There are insufficient checks to deal with stale prices from Chainlink. There should be a require(answeredInround >= roundID) statement for tracking which round data is being used, and fallback to alternate oracles by the guardian if this check reverts.

Impact

Stale prices in a volatile market can be detrimental to the protocol's execution. All functions like borrow and liquidate depend on the getPrice functionality. If the returned price becomes outdated, there maybe a loss of funds to users until guardian changes the oracle address.

Code Snippet

https://github.com/sherlock-audit/2023-02-blueberry/blob/main/contracts/oracle/ChainlinkAdapterOracle.sol#L76

Tool used

Manual Review

Recommendation

Add require(answeredInRound >= roundID) as an additional check

Duplicate of #94