No validation to check the arbitrum sequencer is down
Summary
There is no validation to ensure sequencer is down
Vulnerability Detail
function getLatestRound(ChainlinkAggregator self) internal view returns (ChainlinkRound memory) {
(uint80 roundId, int256 answer, , uint256 updatedAt, ) =
AggregatorProxyInterface(ChainlinkAggregator.unwrap(self)).latestRoundData();
return ChainlinkRound({roundId: roundId, timestamp: updatedAt, answer: answer});
}
/**
* @notice Returns a specific round's data for a specific feed
* @param self Chainlink Feed Aggregator to operate on
* @param roundId The specific round to fetch data for
* @return Specific round's data
*/
function getRound(ChainlinkAggregator self, uint256 roundId) internal view returns (ChainlinkRound memory) {
(, int256 answer, , uint256 updatedAt, ) =
AggregatorProxyInterface(ChainlinkAggregator.unwrap(self)).getRoundData(uint80(roundId));
return ChainlinkRound({roundId: roundId, timestamp: updatedAt, answer: answer});
}
Using Chainlink in L2 chains such as Arbitrum requires to check if the sequencer is down to avoid prices from looking like they are fresh although they are not.
The bug could be leveraged by malicious actors to take advantage of the sequencer downtime.
Impact
when sequencer is down, stale price is used for oracle and the borrow value and collateral value is calculated and the protocol can be forced to rebalance in a loss position
ak1
medium
No validation to check the
arbitrum
sequencer is downSummary
There is no validation to ensure sequencer is down
Vulnerability Detail
Using Chainlink in L2 chains such as Arbitrum requires to check if the sequencer is down to avoid prices from looking like they are fresh although they are not.
The bug could be leveraged by malicious actors to take advantage of the sequencer downtime.
Impact
when sequencer is down, stale price is used for oracle and the borrow value and collateral value is calculated and the protocol can be forced to rebalance in a loss position
Code Snippet
https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-oracle/contracts/types/ChainlinkAggregator.sol#L32-L48
Tool used
Manual Review
Recommendation
we recommend to add checks to ensure the sequencer is not down.
Duplicate of #13