PriceFeeds Manual Review Findings

PFS-01M: Improper Chainlink Integration

Description:

The latestRoundData retrieved from the Chainlink oracle in the getThePrice function is not properly sanitized.

Example:

Copy
26function getThePrice() public view override returns (uint) {
27    (
28    ,
29    int price,
30    ,
31    ,
32    ) = priceFeed.latestRoundData();
33    return uint(price);
34}

Recommendation:

We advise a check to be introduced that ensures answeredInRound has a certain threshold of rounds between itself and roundId to ensure the contract does not process stale data. This particular issue is highlighted in the Chainlink developer documentation.

Alleviation:

The team developed a replacement PriceFeeds implementation labelled DIAPriceFeed that does not interface with Chainlink, thus rendering this implementation redundant and unfixed.