Skip to content

Latest commit

 

History

History
18 lines (15 loc) · 801 Bytes

026.md

File metadata and controls

18 lines (15 loc) · 801 Bytes

Large Orchid Seal

Medium

Insufficient check in getPrice() can return incorrect data

Summary

DebitaChainlink::getPrice is not checking answeredInRound value. The data returned can be incorrect due to an incomplete round.

Vulnerability Details

answeredInRound returns the round ID of the round in which the answer was computed. We should verify that answeredInRound >= roundId to ensure that the data we are seeing is fresh.

Impact

Incorrect price returned by oracle can be very damaging to the protocol.

Code Snippet

https://github.com/sherlock-audit/2024-11-debita-finance-v3/blob/main/Debita-V3-Contracts/contracts/oracles/DebitaChainlink.sol#L30-L47

Tool Used

Manual Review

Recommendation

Add the check require(answeredInRound >= roundId) in getPrice.