Submission Details
Severity:
Lack checks if Arbitrum Sequencer is down
Summary
Lack of Sequencer uptime check on Arbitrum
Vulnerability Details
Chainlink recommends that all L2 oracles consult the Sequencer Uptime Feed to ensure that the sequencer is live before trusting the data returned by the oracle.
Impact
If the Arbitrum sequencer goes down, the protocol will operate at the previous (stale) rates/prices impacting accounting, ratios, health, rebalances, conversions etc.
Tools Used
Manual Analysis
Recommendations
Recommended to follow Chainlink documentation checks for L2 sequencer
https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code as in example below using [startedAt result]
function isSequencerAlive() internal view returns (bool) {
(, int256 answer, uint256 startedAt,,) = sequencer.latestRoundData();
if (block.timestamp - startedAt <= GRACE_PERIOD_TIME || answer == 1)
return false;
return true;
}
function staleCheckLatestRoundData(AggregatorV3Interface priceFeed)
public
view
returns (uint80, int256, uint256, uint256, uint80)
{
require(isSequencerAlive(), "Sequencer is down");
....//remaining parts of the function
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
2,28915 USDC / LOC
33,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.