ChainLink pricer is using a deprecated API

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-tigris/tree/main/contracts/utils/TradingLibrary.sol#L113

Vulnerability details

Description

According to Chainlink’s documentation, the latestAnswer function is deprecated.
This function might suddenly stop working if Chainlink stop supporting deprecated APIs. And the old API can return stale data.

Proof Of Concept

113: int256 assetChainlinkPriceInt = IPrice(_chainlinkFeed).latestAnswer();

https://github.com/code-423n4/2022-12-tigris/tree/main/contracts/utils/TradingLibrary.sol#L113

Recommended Mitigation Steps

Use the latestRoundData function to get the price instead. Add checks on the return data with proper revert messages if the price is stale or the round is uncomplet.
See docs for reference: https://docs.chain.link/docs/price-feeds-api-reference/

[c4-judge]

GalloDaSballo marked the issue as duplicate of #655

[c4-judge]

GalloDaSballo marked the issue as satisfactory