L2 Sequencer Unhandled for Arbitrum and Optimism

Summary

Using Chainlink in L2 chains such as Arbitrum and Optimism requires to check if the sequencer is down to avoid prices from looking like they are fresh although they are not.

The bug could be leveraged by malicious actors to take advantage of the sequencer downtime.

Vulnerability Detail

There is no check in

    function getLatestRound(ChainlinkRegistry self, address base, address quote) internal view returns (ChainlinkRound memory) {
        (uint80 roundId, int256 answer, , uint256 updatedAt, ) =
            FeedRegistryInterface(ChainlinkRegistry.unwrap(self)).latestRoundData(base, quote);
        return ChainlinkRound({roundId: roundId, timestamp: updatedAt, answer: answer});
    }

Impact

Stale prices could be potentially exploited by malicious actors to gain an unfair advantage.

Code Snippet

https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-oracle/contracts/types/ChainlinkRegistry.sol#L34-L38

Tool used

Manual Review

Recommendation

Implement chainlink recommended checks https://docs.chain.link/data-feeds/l2-sequencer-feeds

Duplicate of #13

sherlock-audit / 2023-05-perennial-judging

josephdara - L2 Sequencer Unhandled for Arbitrum and Optimism #229