latestRoundData() is consumed without validating updatedAt (freshness) and answeredInRound >= roundId (completeness). A stale or frozen feed keeps returning the last value; during a market crash or a feed outage the protocol prices assets at an outdated number and mis-collateralises positions.
// If the feed freezes, the old price is used forever: // feed.latestRoundData() -> (id, 2000e8, _, updatedAt = 3 days ago, _) // contract accepts 2000e8 while the real price is 800. // Attacker deposits at the stale-high valuation and drains the shortfall.
(uint80 roundId, int256 answer,, uint256 updatedAt, uint80 answeredInRound) = feed.latestRoundData(); require(answer > 0, "bad price"); require(updatedAt != 0 && block.timestamp - updatedAt <= MAX_DELAY, "stale"); require(answeredInRound >= roundId, "incomplete round");
Largest recorded losses in the same failure class — related, not the same bug:
The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0102 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.