Missing price feed validation in oracle contract

Impact: Medium

Likelihood: Medium

The Oracle contract's _getLastPrice function retrieves price data from oracle price feeds without performing critical validation checks, which could lead to stale or invalid price data being used in the protocol.

Link: https://github.com/Hyperhyperfi/protocol/blob/212acfdcd4066334ff5ea06ce46b0bbca7ca212f/src/core/oracle/Oracle.sol#L96-L101

    function _getLastPrice(address token) internal view returns (uint256 price, uint256 timestamp) {
        (, int256 answer, /* uint256 startedAt */, uint256 updatedAt,) = tokenOracle[token].latestRoundData();

        price = answer.toUint256();
        timestamp = updatedAt;
    }

This vulnerability exists in the following areas:

• Staleness Check:
  • The function does not verify if the price data is fresh by comparing the updatedAt timestamp with the current block.timestamp.
  • Stale price data could be used for critical protocol operations.
• Price Validity:
  • No validation of the answer value to ensure it's not going to go below minAnswer defined by the breaker.
• L2-Specific Concerns:
  • When deployed on L2 networks, the contract lacks sequencer uptime validation (To be validated).

Implement comprehensive price feed validation in the _getLastPrice function.

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.