sherlock-audit / 2023-04-blueberry-judging

8 stars 5 forks source link

Bauchibred - Undesired behaviour of chainlink feeds when sequencer is down #78

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

Bauchibred

medium

Undesired behaviour of chainlink feeds when sequencer is down

Summary

No check to see if sequencer is down in Chainlink feeds

Vulnerability Detail

It is recommended to follow the code example of Chainlink:

See this, but this is not being followed and as such the answer data returned in latestRoundData(), representing sequencer could be any of the following:

// Answer == 0: Sequencer is up // Answer == 1: Sequencer is down

Impact

Chainlink feeds lack check for when seqquencer is down

Code Snippet

https://github.com/sherlock-audit/2023-04-blueberry/blob/96eb1829571dc46e1a387985bd56989702c5e1dc/blueberry-core/contracts/oracle/ChainlinkAdapterOracle.sol#L77-L97

Tool used

Manual Review

Recommendation

Introduce a method to check if the sequencer is down in the protocol this could be done by implementing a boolean check as simple as the bbelow:

 bool isSequencerUp = answer == 0;
        if (!isSequencerUp) {
            revert SequencerDown();
        }

Duplicate of #142