Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

No check if Arbitrum L2 sequencer is down in Chainlink feeds

owade

Summary

Assuming this contract will be deployed to L2 chains.Using Chainlink in L2 chains such as Arbitrum requires to check if the sequencer is down to avoid prices from looking like they are fresh although they are not.

Vulnerability Details

In OracleLib.sol , there is no check to see if the sequencer is done which will lead to stale prices.

function staleCheckLatestRoundData(AggregatorV3Interface chainlinkFeed)
public
view
returns (uint80, int256, uint256, uint256, uint80)
{
(uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
chainlinkFeed.latestRoundData();
​
if (updatedAt == 0 || answeredInRound < roundId) {
revert OracleLib__StalePrice();
}
uint256 secondsSince = block.timestamp - updatedAt;
if (secondsSince > TIMEOUT) revert OracleLib__StalePrice();
​
return (roundId, answer, startedAt, updatedAt, answeredInRound);
}

Impact

Users can get better borrows if the price is above the actual price
Users can avoid liquidations if the price is under the actual price

Tools Used

Manual review

Recommendations

It is recommended to follow the code example of Chainlink:
https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.