Oracle staleness check present
Compound V3 (Comet)'s assessment for RD-F-059 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No staleness check. Comet discards updatedAt from latestRoundData(). USDC/USD heartbeat is 82,800s (23h); stale prices silently accepted for up to 23–24h.
Detail #
Comet.sol getPrice(): '(, int price, , , ) = IPriceFeed(priceFeed).latestRoundData()' — the updatedAt timestamp (4th return value) is explicitly discarded via the blank destructuring. No comparison of updatedAt against block.timestamp - maxStaleness anywhere in the codebase. The USDC/USD Chainlink feed (0x8fFfFfd4AfB6115b954Bd326cbe7B4BA576818f6) has an 82,800s heartbeat, meaning a stale price up to 23h old would be accepted.
Sources #
- GitHubComet.sol oracle call with missing staleness checkComet.sol getPrice() — updatedAt not capturedretrieved 2026-04-27
Methodology #
Determine whether the protocol rejects oracle reads older than a declared maximum age (i.e., checks `updatedAt > block.timestamp - maxStaleness`).
See the full factor methodology and distribution across all protocols →