search

hats-finance / Velvet-Capital-0x0bb0c08fd9eeaf190064f4c66f11d18182961f77

Core smart contracts of Velvet Capital
Other
0 stars 1 forks source link

No check for active Arbitrum Sequencer in `PriceOracle` #40

Open hats-bug-reporter[bot] opened 1 week ago

hats-bug-reporter[bot] commented 1 week ago

Github username: -- Twitter username: p_tolev Submission hash (on-chain): 0x3587663b56f6e3692983dd8491f33e2daa72c021b4358227f6569fb8819a9bca Severity: low

Description: Description\ Chainlink advises all Optimistic L2 oracles to consult the Sequencer Uptime Feed, ensuring the sequencer is live before trusting the data returned by the oracle. This check is bypassed in the PriceOracle._latestRoundData() function, which is later used to convert the asset price to USD in PriceOracleAbstract.convertToUSD18Decimals().

Attack Scenario\ If the Arbitrum Sequencer becomes unavailable, the oracle data will not update, potentially becoming stale. Despite this, users can continue interacting with the protocol. Please refer to Chainlink's documentation on L2 Sequencer Uptime Feeds for more information.

Consequently, users might operate the protocol while oracle feeds are stale, leading to several potential issues. Here's a simple example:

  1. A user has an account with 100 tokens, each valued at 1 ETH, with no borrows.
  2. The Arbitrum sequencer temporarily goes offline.
  3. During this downtime, the token price drops to 0.5 ETH each.
  4. This leads to an incorrect conversion of the token price to USD.

Attachments

  1. Proof of Concept (PoC) File

  2. Revised Code File (Optional)

Files:

langnavina97 commented 1 week ago

DUPLICATE #28

The PriceOracleL2 contract already includes the necessary checks to ensure the sequencer's status is verified, preventing the usage of stale prices. This mitigates the risk described in the attack scenario.