bitsurfer - No check if Arbitrum L2 sequencer is down

[sherlock-admin]

bitsurfer

medium

No check if Arbitrum L2 sequencer is down

Summary

No check if Arbitrum L2 sequencer is down

Vulnerability Detail

Chainlink suggests that all Optimistic Layer 2 (L2) oracles should refer to the Sequencer Uptime Feed provided by the L2 solution to verify the availability of the sequencer before relying on the data returned by the oracle.

In the context of the smart contracts being deployed on Arbitrum, it is important to consider the scenario where the Arbitrum Sequencer experiences downtime. In such cases, the oracle data may not be updated regularly and could become outdated or stale. However, despite the Sequencer downtime, users still have the ability to directly interact with the protocol through the L1 optimistic rollup contract.

To ensure data accuracy and integrity, it is recommended to consult the Chainlink documentation on L2 Sequencer Uptime Feeds for a more comprehensive understanding of the mechanisms and considerations involved. By incorporating these best practices, the smart contracts can mitigate the risks associated with potential Sequencer downtime and maintain the reliability of the oracle data.

File: ChainlinkAggregator.sol
32:     function getLatestRound(ChainlinkAggregator self) internal view returns (ChainlinkRound memory) {
33:         (uint80 roundId, int256 answer, , uint256 updatedAt, ) =
34:             AggregatorProxyInterface(ChainlinkAggregator.unwrap(self)).latestRoundData();
35:         return ChainlinkRound({roundId: roundId, timestamp: updatedAt, answer: answer});
36:     }

File: ChainlinkRegistry.sol
34:     function getLatestRound(ChainlinkRegistry self, address base, address quote) internal view returns (ChainlinkRound memory) {
35:         (uint80 roundId, int256 answer, , uint256 updatedAt, ) =
36:             FeedRegistryInterface(ChainlinkRegistry.unwrap(self)).latestRoundData(base, quote);
37:         return ChainlinkRound({roundId: roundId, timestamp: updatedAt, answer: answer});
38:     }

Impact

If the Arbitrum sequencer goes down, the protocol will allow users to continue to operate at the previous (stale) rates.

Code Snippet

https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-oracle/contracts/types/ChainlinkAggregator.sol#L32-L36

Tool used

Manual Review

Recommendation

To ensure the availability of the sequencer and prevent order execution when the sequencer is offline, you can utilize the sequencer oracle. By using the sequencer oracle, you can determine the status of the sequencer and take appropriate actions based on its availability.

Check the Chainlink docs: https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

Duplicate of #13