15,000 USDC
View results
Submission Details
Severity: medium
Valid

No check if the sequencer is down when calling the chainlink oracle for L2s

Summary

The DSC can be deployed on any EVM, also on L2s like Optimism and Arbitrum. L2s use a sequencer to synchronize their transactions and data with the Ethereum network. If the sequencer is down the price from the oracle can be stale and lead to wrong calculations of the healthFactor and therefor enable users to mint more DSC than they should be able to.

Vulnerability Details

See summary

Impact

If the sequencer is down, the price of a collateral asset might fall but the protocol would still allow minting DSC at the higher price. This is especially dangerous if the heartbeat of the oracle is long, eg 24 hours like with SOL/USD.

Tools Used

Manual review

Recommendations

It is recommended to follow the code example of Chainlink:
https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.