Using Chainlink in L2 chains such as Arbitrum and Optimism requires to check if the sequencer is down to avoid prices from looking like they are fresh although they are not.
The bug could be leveraged by malicious actors to take advantage of the sequencer downtime.
josephdara
medium
L2 Sequencer Unhandled for Arbitrum and Optimism
Summary
Using Chainlink in L2 chains such as Arbitrum and Optimism requires to check if the sequencer is down to avoid prices from looking like they are fresh although they are not.
The bug could be leveraged by malicious actors to take advantage of the sequencer downtime.
Vulnerability Detail
There is no check in
Impact
Stale prices could be potentially exploited by malicious actors to gain an unfair advantage.
Code Snippet
https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-oracle/contracts/types/ChainlinkRegistry.sol#L34-L38
Tool used
Manual Review
Recommendation
Implement chainlink recommended checks https://docs.chain.link/data-feeds/l2-sequencer-feeds
Duplicate of #13