Summary

The protocol is expected to be functional on any EVM chain (source: discord contest channel). When utilizing Chainlink in L2 chains like Arbitrum or Optimism, it's important to ensure that the prices provided are not falsely perceived as fresh, even when the sequencer is down. This vulnerability could potentially be exploited by malicious actors to gain an unfair advantage.

Vulnerability Details

Optimistic rollup protocols move all execution off the layer 1 (L1) Ethereum chain, complete execution on a layer 2 (L2) chain, and return the results of the L2 execution back to the L1. These protocols have a sequencer that executes and rolls up the L2 transactions by batching multiple transactions into a single transaction.

If a sequencer becomes unavailable, it is impossible to access read/write APIs that consumers are using and applications on the L2 network will be down for most users without interacting directly through the L1 optimistic rollup contracts. The L2 has not stopped, but it would be unfair to continue providing service on your applications when only a few users can use them.

To help your applications identify when the sequencer is unavailable, you can use a data feed that tracks the last known status of the sequencer at a given point in time. This helps you prevent mass liquidations by providing a grace period to allow customers to react to such an event.

Source: Chainlink docs.

Impact

Without checking the sequencer status, a stale price may mistakenly be used. This leads to mispricing of assets, which can lead to unfair liquidation and/or protocol undercollateralization. In these scenarios users funds would be lost.

Tools Used

Manual review

Recommendations

Implement a sequencer check as shown in Chainlinks docs.