The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

LiquidationPool's `distributeAssets` doesn't check If Arbitrum sequencer is down in Chainlink feeds

chainnue

Summary

LiquidationPool's distributeAssets doesn't check If Arbitrum sequencer is down in Chainlink feeds

Vulnerability Details

When utilizing Chainlink in L2 chains like Arbitrum, it's important to ensure that the prices provided are not falsely perceived as fresh, even when the sequencer is down. This vulnerability could potentially be exploited by malicious actors to gain an unfair advantage.

File: LiquidationPool.sol
205: function distributeAssets(ILiquidationPoolManager.Asset[] memory _assets, uint256 _collateralRate, uint256 _hundredPC) external payable {
...
207: (,int256 priceEurUsd,,,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
...
211: for (uint256 j = 0; j < holders.length; j++) {
212: Position memory _position = positions[holders[j]];
213: uint256 _positionStake = stake(_position);
214: if (_positionStake > 0) {
215: for (uint256 i = 0; i < _assets.length; i++) {
216: ILiquidationPoolManager.Asset memory asset = _assets[i];
217: if (asset.amount > 0) {
218: (,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
...
234: }
235: }
236: }
...
238: }
...
241: }

Impact

could potentially be exploited by malicious actors to gain an unfair advantage.

Tools Used

Manual Analysis

Recommendations

Consider to implement code example from Chainlink: https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Arbitrum-sequncer

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Arbitrum-sequncer

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.