15,000 USDC
View results
Submission Details
Severity: medium
Valid

No check if Arbitrum L2 sequencer is down in Chainlink feeds

Summary

It is assumed that the project is supposed to be deployed on any EVM-based chain. Using Chainlink in L2 chains such as Arbitrum requires checking if the sequencer is down to avoid prices from looking like they are fresh although they are not.

Vulnerability Details

In OracleLib.sol, staleCheckLatestRoundData() function is used the get the price of the tokens. There is no check that the sequencer is down.

In DSCEngine.sol, staleCheckLatestRoundData() is utilized in getTokenAmountFromUsd() and getUsdValue().

Impact

The bug could be leveraged by malicious actors to take advantage of the sequencer downtime.

Tools Used

Manual Analysis

Recommendations

It is recommended to follow the code example of Chainlink:
https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.