Foundry DeFi Stablecoin CodeHawks Audit Contest

Summary

When utilizing Chainlink in L2 chains like Arbitrum, it's important to ensure that the prices provided are not falsely perceived as fresh, even when the sequencer is down.

Vulnerability Details

From Chainlink documentation:
Optimistic rollup protocols have a sequencer that executes and rolls up the L2 transactions by batching multiple transactions into a single transaction.
If a sequencer becomes unavailable, it is impossible to access read/write APIs that consumers are using and applications on the L2 network will be down for most users.
This means that if the project does not check if the sequencer is down, it can return stale results.

Note that It is a different issue from checking oracle price freshness.
Because in the case of sharp price fluctuations, the price may be updated several times, although the final price is in freshness, but it may not be the latest price.
There's a similar issue here.

Impact

Invalid or stale prices may be returned for the protocol

Tools Used

Manual Review

Recommendations

From Chainlink documentation:
Check L2 sequencer status.