OpenEden Disclosed Report

https://github.com/OpenEdenHQ/openeden.usdoexpress.audit/tree/f3f31d2ac15e3253cba342229f9d05495f95d6fd

Summary

The AssetRegistry::_getFreshPrice function implements stale price checks using the deprecated answeredInRound parameter from Chainlink's latestRoundData() function. According to Chainlink's official documentation, this parameter is no longer maintained and should not be used for validation purposes.

Description

The _getFreshPrice function retrieves price data from Chainlink price feeds and performs several validation checks to ensure data quality:

function _getFreshPrice(address priceFeed) internal view returns (uint256 price, uint8 decimals) {
    (uint80 roundId, int256 answer, , uint256 updatedAt, uint80 answeredInRound) = IPriceFeed(priceFeed)
        .latestRoundData();

    if (answer <= 0) revert AssetRegistryInvalidPrice(answer);
    if (block.timestamp - updatedAt > maxStalePeriod) {
        revert AssetRegistryStalePriceData(updatedAt, block.timestamp, maxStalePeriod);
    }

    // Check for incomplete round data
  
@>    if (answeredInRound < roundId) {
        revert AssetRegistryStalePriceData(updatedAt, block.timestamp, maxStalePeriod);
    }

    price = uint256(answer);
    decimals = IPriceFeed(priceFeed).decimals();
}

Why This Is a Problem:

According to Chainlink's official documentation, the answeredInRound parameter has been deprecated and is no longer guaranteed to be accurate or maintained.

Impact

1. No Guarantee of Accuracy: The answeredInRound value may not be reliably updated or maintained by Chainlink oracles across different feeds
2. Inconsistent Behavior: The deprecated parameter may behave differently across various Chainlink price feeds, networks, or oracle versions
3. Price Query DOS:The unreliable deprecated check may incorrectly reject valid price data, causing legitimate transactions to revert

Mitigation

• Remove the deprecated answeredInRound check entirely and rely on the robust updatedAt timestamp validation

Proof Of Concept

Reference Documentation:

According to Chainlink's official API documentation for latestRoundData():

Source: https://docs.chain.link/data-feeds/api-reference#latestrounddata

The documentation explicitly states that answeredInRound is deprecated and should not be used for validation purposes. The return values section shows:

• roundId: The round ID
• answer: The price
• startedAt: Timestamp of when the round started
• updatedAt: Timestamp of when the round was updated
• answeredInRound: Deprecated - Previously used for tracking round completion