Most secure way to get ERC20 token price in Solidity (Polygon network) [duplicate]

Question

I'm building infrastructure for a blockchain game where users can spend ERC20 tokens to buy tickets whose prices are $0.25, $0.5, $1, etc. For that, I need to get ERC20 token current price in stablecoin. What is the most secure way to do that?

Right now I get reserves from Quickswap pair and do calculations:

function getStableCoinPrice(address pairAddress, address erc20Address) public view returns (uint256) {
    IUniswapV2Pair pair = IUniswapV2Pair(pairAddress);
    (uint256 reserve0, uint256 reserve1, ) = pair.getReserves();

    (uint256 reserveA, uint256 reserveB) = erc20Address == pair.token0() ? (reserve0, reserve1) : (reserve1, reserve0);

    ERC20 stableCoin = erc20Address == pair.token0() ? ERC20(pair.token1()) : ERC20(pair.token0());
    
    // returns amount of ERC20 needed to buy 1 stablecoin
    return (reserveA * (10**stableCoin.decimals())) / reserveB;
}

Is it a secure way to get the price of a token? I think it's vulnerable to flash load attacks, am I right? Should Chainlink price feed oracle be used instead?

Answer 1

That can work fine, but you're right on the flash attacks, so you just need to think about how likely an attack is.

Chainlink has some price feeds up you can read, but if you want something more custom, take a look at www.tellor.io. You can get really custom ERC20 prices quickly and in a decentralized way.