`getPrice()` accepts stale oracle answers

[sunoj]

Severity: High

Comet.getPrice() discards all freshness fields from latestRoundData() (updatedAt, roundId, answeredInRound) and accepts any positive price unconditionally.

This means every collateral check, liquidation, absorption, and collateral quote can operate on an arbitrarily stale price.

function getPrice(address priceFeed) override public view returns (uint256) {
    (, int price, , , ) = IPriceFeed(priceFeed).latestRoundData();
    if (price <= 0) revert BadPrice();
    return uint256(price);
}

Impact: If a feed stops updating, stale-high prices let borrowers over-withdraw collateral; stale-low prices let healthy accounts be unfairly liquidated.

Recommendation: Validate freshness before accepting the answer:

(uint80 roundId, int256 price, , uint256 updatedAt, uint80 answeredInRound) =
    IPriceFeed(priceFeed).latestRoundData();
if (price <= 0 || updatedAt == 0 || answeredInRound < roundId ||
    block.timestamp - updatedAt > maxStaleness) revert BadPrice();

— whitedog