Deprecated Chainlink latestAnswer() Enables Stale Price Attacks
Claim: Chainlink oracle price feeds that use deprecated latestAnswer() without staleness checks enable attackers to drain DeFi protocols via stale price exploitation when feeds halt.
Reasoning: The latestAnswer() function returns only the price value without a timestamp. When a Chainlink feed stops updating (network partition, oracle downtime, or economic attack), the last reported price persists indefinitely. Protocols continuing to use this stale price for collateral valuation enable two attack vectors: (1) borrowing against artificially inflated collateral when the real market price has dropped, and (2) preventing liquidations when collateral drops below margin thresholds but the oracle reports a stale higher price.
Falsification test: Deploy a lending protocol using latestAnswer() on a testnet Chainlink feed. Halt the feed's heartbeat via a simulated network partition. Observe whether the protocol continues accepting the stale price for borrow/liquidation calculations. Expected outcome: protocol accepts stale data without revert.
Evidence:
- Inverse Finance exploit (April 2022): 5.6M loss via stale Chainlink oracle. Documented in Immunefi report: https://medium.com/immunefi/inverse-finance-price-oracle-manipulation-bug-fix-postmortem-d2364bf1b4
- Chainlink Engineering Tutorials recommend latestRoundData() with staleness validation: https://docs.chain.link/data-feeds/historical-data#getrounddata-return-values
- OpenZeppelin Contracts Security Advisories reference unsafe int256→uint256 casts on latestAnswer(): https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories
Domain fit: Smart contract security, oracle manipulation, DeFi vulnerability research.