Moonwell

The latestRoundData() function returns block.timestamp as the updatedAt value instead of the actual minimum timestamp from underlying Chainlink feeds. Any downstream staleness check will always see the price as fresh, even when underlying feeds are stale. This affects derivative assets including wstETH, cbETH, rETH, weETH, wrsETH, and LBTC.

Stale prices from underlying Chainlink feeds could be used for lending/borrowing decisions without detection, potentially enabling users to supply overvalued collateral, borrow against stale prices, or avoid proper liquidation.

Return the minimum updatedAt timestamp from all underlying oracle feeds instead of block.timestamp.

The _getLoanTokenPrice function only checks loanAnswer > 0 but does not validate updatedAt != 0 or answeredInRound >= roundId. The equivalent function in ChainlinkOEVWrapper properly calls _validateRoundData with all checks. A stale loan token price affects the collateral split calculation in updatePriceEarlyAndLiquidate.

A stale loan token price could cause incorrect collateral split between liquidator and protocol fee recipient during OEV liquidations through the Morpho wrapper.

Add full round data validation using _validateRoundData, matching the pattern in ChainlinkOEVWrapper._getLoanTokenPrice.

In latestRoundData(), _validateRoundData is called inside the try block’s success handler. The catch block only catches reverts from the external call originalFeed.getRoundData(). If the external call succeeds but the returned data fails validation, the revert propagates up uncaught, causing the entire latestRoundData() to revert. This differs from ChainlinkOEVWrapper which correctly validates only after the loop.

If any previous round has data that fails validation (e.g., incomplete round with updatedAt==0), the oracle becomes temporarily unusable, freezing all market operations (supply, borrow, redeem, liquidation) until the maxRoundDelay passes.

Use soft validation (if-check) inside the loop and reserve the hard revert for the final fallback, matching ChainlinkOEVWrapper’s pattern.

The getChainlinkPrice function in ChainlinkOracle.sol checks that updatedAt != 0 and answer > 0, but does not validate that the price data is recent by comparing updatedAt against a maximum staleness threshold (heartbeat). Additionally, it is missing the answeredInRound >= roundId check that the OEV wrappers include. The same missing heartbeat check also applies to ChainlinkCompositeOracle.sol (getPriceAndDecimals at line 167) and ChainlinkBoundedCompositeOracle.sol (_getValidatedOracleData at line 213). Without a heartbeat check, if a Chainlink feed stops updating (e.g., during network congestion or feed deprecation), the protocol will continue using an arbitrarily stale price, which could allow undercollateralized borrowing or prevent valid liquidations.

An attacker could exploit a stale oracle price to borrow against inflated collateral values or avoid liquidation. If a Chainlink feed goes stale during a price crash, positions that should be liquidated will remain open, leading to bad debt accrual for the protocol. Conversely, if the feed goes stale during a price pump, users could be unfairly liquidated based on an outdated lower price.

Add a configurable heartbeat duration check to all oracle price validation functions. Each feed should have a maximum allowed staleness period (matching the Chainlink feed’s heartbeat, e.g., 3600s for most feeds, 86400s for some). Also add the missing answeredInRound >= roundId check to ChainlinkOracle.getChainlinkPrice.