Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

In OracleLib.sol, Missing check for active Arbitrum Sequencer

0xrizwan

Summary

Chainlink recommends that all Optimistic L2 oracles consult the Sequencer Uptime Feed to ensure that the sequencer is live before trusting the data returned by the oracle. This check is missing in OracleLib.sol.

Vulnerability Details

Per the discord discussion,the smart contracts will be deployed on any EVM chain which also includes L2 like Arbitrum. The issue here is, if the Arbitrum Sequencer goes down, oracle data will not be kept up to date, and thus could become stale. However, users are able to continue to interact with the protocol directly through the L1 optimistic rollup contract. You can review Chainlink docs on L2 Sequencer Uptime Feeds for more details on this.

Arbitrum L2

However, this L2 Sequencer is missing in current implemetation which can be seen as below,

File: src/libraries/OracleLib.sol
​
21 function staleCheckLatestRoundData(AggregatorV3Interface priceFeed)
22 public
23 view
24 returns (uint80, int256, uint256, uint256, uint80)
25 {
26 (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
27 priceFeed.latestRoundData();
28
29 uint256 secondsSince = block.timestamp - updatedAt;
30 if (secondsSince > TIMEOUT) revert OracleLib__StalePrice();
31
32 return (roundId, answer, startedAt, updatedAt, answeredInRound);
33 }

As a result, users may be able to use the protocol while oracle feeds are stale. This could cause many problems, but as a simple example:

  • A user has an account with 100 tokens, valued at 1 ETH each, and no borrows

  • The Arbitrum sequencer goes down temporarily

  • While it’s down, the price of the token falls to 0.5 ETH each

  • The current value of the user’s account is 50 ETH, so they should be able to borrow a maximum of 200 ETH to keep account healthy ((200 + 50) / 200 = 1.2)
    Because of the stale price, the protocol lets them borrow 400 ETH ((400 + 100) / 400 = 1.2)

Impact

If the Arbitrum sequencer goes down, the protocol will allow users to continue to operate at the previous (stale) rates.

Tools Used

Manual Review

Recommendations

Use sequencer oracle to determine whether the sequencer is offline or not, and don't allow orders to be executed while the sequencer is offline.

Check the Chainlink Documentation for a full example: https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

Also check the queue system here: https://docs.chain.link/data-feeds/l2-sequencer-feeds/

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.