Oracle doesn't check if Arbitrum Sequencer is active

Summary

Arrakis is going to deployed on Ethereum, Arbitrum, Gnosis, so when using Chainlink on Arbitrum requires to check if the sequencer is down.

The bug could be leveraged by malicious actors to take advantage of the sequencer downtime.

Vulnerability Detail

There is a lack of a check if the L2 Arbitrum sequencer is down in valantis-hot/src/HOTOracle.sol.

  function _getOraclePriceUSD(
        AggregatorV3Interface feed,
        uint32 maxOracleUpdateDuration
    ) internal view returns (uint256 oraclePriceUSD) {
        (, int256 oraclePriceUSDInt, , uint256 updatedAt, ) = feed.latestRoundData();

        if (block.timestamp - updatedAt > maxOracleUpdateDuration) {
            revert HOTOracle___getOraclePriceUSD_stalePrice();
        }

        oraclePriceUSD = oraclePriceUSDInt.toUint256();
    }

Impact

could potentially be exploited by malicious actors to gain an unfair advantage.

Code Snippet

https://github.com/sherlock-audit/2024-03-arrakis/blob/main/valantis-hot/src/HOTOracle.sol#L138-L149

Tool used

Manual Review

Recommendation

It is recommended to follow the code example of Chainlink: https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

sherlock-audit / 2024-03-arrakis-judging

skyge - Oracle doesn't check if Arbitrum Sequencer is active #40