# Missing price staleness check for WEETH_AGGREGATOR

EETHPriceAdapter uses latestAnswer for the WETH/ETH Chainlink feed without a staleness check, so a stale secondary oracle yields an invalid eETH/USD price.

- Payout: Contest reward
- Severity: medium
- Program: BendDAO
- Credited: oakcobalt
- Disclosed: 2025-01-22
- Write-up quality: 6/10
- Original: https://code4rena.com/reports/2024-12-benddao-invitational#m-03
- Library page: https://bugbountylibrary.com/r/c4%3A2024-12-benddao-invitational%3AM-03
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:medium tech:solidity technique:source-review vuln:oracle-manipulation

**Target:** EETHPriceAdapter / PriceOracle Chainlink price feed adapter
**Root cause:** EETHPriceAdapter::latestRoundData only propagates BASE_AGGREGATOR (ETH/USD) round metadata, while WEETH_AGGREGATOR (WETH/ETH) is read via latestAnswer with no updatedAt/answeredInRound, so PriceOracle's staleness requires only cover the base feed.
**Steps:**
1. Call PriceOracle::getAssetPriceFromChainlink(eETH) which routes to EETHPriceAdapter::latestRoundData().
2. Observe EETHPriceAdapter calls BASE_AGGREGATOR.latestRoundData() but WEETH_AGGREGATOR.latestAnswer() only.
3. Note returned updatedAt/answeredInRound originate solely from BASE_AGGREGATOR.
4. PriceOracle checks answer>0, updatedAt!=0, answeredInRound>=roundId on base feed only.
5. If WEETH_AGGREGATOR goes stale, _convertWEETHPrice still uses the stale weETHPrice, producing an incorrect eETH/USD answer with no revert.
**How found:** Code reading of the oracle adapter chain: noticed the two-aggregator design returns metadata from only one feed and that the second is queried via the deprecated latestAnswer, which carries no timestamp.
**Exploitation:** Not described; a stale WETH/ETH feed would silently feed an incorrect eETH/USD price into the oracle, potentially enabling mispriced borrows/liquidations, but no concrete attack flow is given.
**Insight:** When an adapter composes multiple Chainlink feeds, verify each feed's round metadata is propagated and checked; a secondary feed read via latestAnswer silently bypasses the consumer's staleness guards.