use of deprecated chainlink latestAnswer can return stale data

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/Trading.sol#L574
https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/TradingExtension.sol#L98
https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/TradingExtension.sol#L172-L180
https://github.com/code-423n4/2022-12-tigris/blob/main/contracts/utils/TradingLibrary.sol#L113

Vulnerability details

Impact

latestAnswer in ChainLink Api is deprecated according to chainlink docs https://docs.chain.link/data-feeds/price-feeds/ .This might return stale data or returns 0 in the event of an error. If it returns stale data, verifyPrice might fail due to difference in price or succeed even though the fresh price from chainlink is not within the tolerance of the other oracle price. If it returns 0, no checks are done and the other oracle gets to dictate the price.

Proof of Concept

limitClose in Trading.sol is the function that is affected by this. Order of calling is limitClose -> _limitClose -> getVerifiedPrice -> verifyPrice.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider using the latestRoundData to get price

       (uint80 roundID, int256 assetChainlinkPriceInt, , uint256 timestamp, uint80 answeredInRound) = IPrice(_chainlinkFeed).latestRoundData();

        require(assetChainlinkPriceInt > 0, "Price have to be more than 0");
        require(answeredInRound >= roundID, "Stale price");
        require(timestamp > 0, "Round not completed");

[c4-judge]

GalloDaSballo marked the issue as duplicate of #655

[c4-judge]

GalloDaSballo marked the issue as satisfactory