Closed sherlock-admin closed 1 year ago
J4de
medium
ChainlinkAdapterOracle.sol#getPrice
sequencerUptimeFeed
ChainlinkAdapterOracle.sol#getPrice function does not check sequencerUptimeFeed
To use the chainlink oracle on the L2 chain, you must first check the sequencerUptimeFeed.
This is the official chainlink example: https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code
May result in an unexpected price.
https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/oracle/ChainlinkAdapterOracle.sol#L77-L97
Manual Review
function getPrice(address token_) external view override returns (uint256) { // remap token if possible address token = remappedTokens[token_]; if (token == address(0)) token = token_; uint256 maxDelayTime = timeGaps[token]; if (maxDelayTime == 0) revert Errors.NO_MAX_DELAY(token_); + (, int256 answer, uint256 startedAt, , ) = sequencerUptimeFeed.latestRoundData(); + // Answer == 0: Sequencer is up + // Answer == 1: Sequencer is down + bool isSequencerUp = answer == 0; + if (!isSequencerUp) { revert SequencerDown(); } // Get token-USD price uint256 decimals = registry.decimals(token, USD); (, int256 answer, , uint256 updatedAt, ) = registry.latestRoundData( token, USD ); if (updatedAt < block.timestamp - maxDelayTime) revert Errors.PRICE_OUTDATED(token_); if (answer <= 0) revert Errors.PRICE_NEGATIVE(token_); return (answer.toUint256() * Constants.PRICE_PRECISION) / 10 ** decimals; }
Duplicate of #142
J4de
medium
ChainlinkAdapterOracle.sol#getPrice
function does not checksequencerUptimeFeed
Summary
ChainlinkAdapterOracle.sol#getPrice
function does not checksequencerUptimeFeed
Vulnerability Detail
To use the chainlink oracle on the L2 chain, you must first check the
sequencerUptimeFeed
.This is the official chainlink example: https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code
Impact
May result in an unexpected price.
Code Snippet
https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/oracle/ChainlinkAdapterOracle.sol#L77-L97
Tool used
Manual Review
Recommendation
Duplicate of #142