No check if Arbitrum L2 sequencer is down in Chainlink feeds

Severity

Medium Risk

Summary

Assuming this contract will be deployed to L2 chains.Using Chainlink in L2 chains such as Arbitrum requires to check if the sequencer is down to avoid prices from looking like they are fresh although they are not.

Vulnerability Details

In OracleLib.sol , there is no check to see if the sequencer is done which will lead to stale prices.

   function staleCheckLatestRoundData(AggregatorV3Interface chainlinkFeed)
        public
        view
        returns (uint80, int256, uint256, uint256, uint80)
    {
        (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
            chainlinkFeed.latestRoundData();

        if (updatedAt == 0 || answeredInRound < roundId) {
            revert OracleLib__StalePrice();
        }
        uint256 secondsSince = block.timestamp - updatedAt;
        if (secondsSince > TIMEOUT) revert OracleLib__StalePrice();

        return (roundId, answer, startedAt, updatedAt, answeredInRound);
    }

Impact

Users can get better borrows if the price is above the actual price Users can avoid liquidations if the price is under the actual price

Tools Used

Manual review

Recommendations

It is recommended to follow the code example of Chainlink: https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

Cyfrin / 2023-07-foundry-defi-stablecoin

No check if Arbitrum L2 sequencer is down in Chainlink feeds #1117