Using deprecated Chainlink function latestAnswer()

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/utils/TradingLibrary.sol#L113

Vulnerability details

Impact

According to Chainlink's documentation, the latestAnswer() function is deprecated.

The following could happen:

• Deprecated API stops working. Prices cannot be obtained, if Chainlink stopped supporting deprecated APIs.
• Protocol stops and contracts have to be redeployed.

Proof of Concept

File: contracts/utils/TradingLibrary.sol
113:             int256 assetChainlinkPriceInt = IPrice(_chainlinkFeed).latestAnswer();

Reference:

Chainlink - latestanswer

Recommended Mitigation Steps

Use the latestRoundData() function to get the price instead. Add checks on the return data with proper revert messages if the price is stale or the round is incomplete, for example:

    (uint80 roundID, int256 assetChainlinkPriceInt, , uint256 timeStamp, uint80 answeredInRound) = oracle.latestRoundData();
    require(answeredInRound >= roundID, "...");
    require(timeStamp != 0, "...");
    if (assetChainlinkPriceInt != 0) {
        // ...

[c4-judge]

GalloDaSballo marked the issue as duplicate of #655

[c4-judge]

GalloDaSballo marked the issue as satisfactory