getUnderlyingPrice() doesn't check If Arbitrum sequencer is down in Chainlink feeds
Summary
When utilizing Chainlink in L2 chains like Arbitrum, it's important to ensure that the prices provided are not falsely perceived as fresh, even when the sequencer is down. This vulnerability could potentially be exploited by malicious actors to gain an unfair advantage.
Vulnerability Detail
If the Arbitrum Sequencer goes down, oracle data will not be kept up to date, and thus could become stale. However, users are able to continue to interact with the protocol directly through the L1 optimistic rollup contract. You can review Chainlink docs on L2 Sequencer Uptime Feeds for more details on this.
As a result, users may be able to use the protocol while oracle feeds are stale. This could cause many problems, but as a simple example:
A user has an account with 100 tokens, valued at 1 ETH each, and no borrows
The Arbitrum sequencer goes down temporarily
While it's down, the price of the token falls to 0.5 ETH each
The current value of the user's account is 50 ETH, so they should be able to borrow a maximum of 200 ETH
But because of the stale price, the protocol lets them borrow 400 ETH
Impact
If the Arbitrum sequencer goes down, the protocol will allow users to continue to operate at the previous (stale) rates that could potentially be exploited by malicious actors to gain an unfair advantage.
BugBusters
medium
getUnderlyingPrice()doesn't check If Arbitrum sequencer is down in Chainlink feedsSummary
When utilizing Chainlink in L2 chains like Arbitrum, it's important to ensure that the prices provided are not falsely perceived as fresh, even when the sequencer is down. This vulnerability could potentially be exploited by malicious actors to gain an unfair advantage.
Vulnerability Detail
If the Arbitrum Sequencer goes down, oracle data will not be kept up to date, and thus could become stale. However, users are able to continue to interact with the protocol directly through the L1 optimistic rollup contract. You can review Chainlink docs on L2 Sequencer Uptime Feeds for more details on this.
As a result, users may be able to use the protocol while oracle feeds are stale. This could cause many problems, but as a simple example:
A user has an account with 100 tokens, valued at 1 ETH each, and no borrows The Arbitrum sequencer goes down temporarily While it's down, the price of the token falls to 0.5 ETH each The current value of the user's account is 50 ETH, so they should be able to borrow a maximum of 200 ETH But because of the stale price, the protocol lets them borrow 400 ETH
Impact
If the Arbitrum sequencer goes down, the protocol will allow users to continue to operate at the previous (stale) rates that could potentially be exploited by malicious actors to gain an unfair advantage.
Code Snippet
https://github.com/sherlock-audit/2023-04-hubble-exchange/blob/main/hubble-protocol/contracts/Oracle.sol#L24-L36
Tool used
Manual Review
Recommendation
code example of Chainlink: https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code