Summary

Patrick Collins has stated that we should assume the stablecoin to be deployed on any EVM chain.

Currently, there is no check to see if the Arbitrum sequencer is down on Chainlink feeds which means prices can be provided which would be falsely perceived as fresh.

Vulnerability Details

When utilizing Chainlink in L2 chains like Arbitrum, it's important to ensure that the prices provided are not falsely perceived as fresh, even when the sequencer is down. There currently is no check present in OracleLib.sol to assure that the L2 chain is online.

The price feeds can typically update several times within a threshold period if the price is moving a lot. When the sequencer is down, the new price won't be reported to the chain. The feed on the L2 will return the value it had when it went down.

Impact

This vulnerability could potentially be exploited by malicious actors to gain an unfair advantage.

Tools Used

Manual review

Recommendations

Adapt the code example mentioned in the chainlink documentation to check for sequencer uptime.

https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code