The Standard

Summary

Chainlink recommends that all Optimistic L2 oracles consult the Sequencer Uptime Feed to ensure that the sequencer is live before trusting the data returned by the oracle. while there is no such check is implemented

Vulnerability Details

If the Arbitrum Sequencer goes down, oracle data will not be kept up to date, and thus could become stale. However, users are able to continue to interact with the protocol directly through the L1 optimistic rollup contract. You can review Chainlink docs on L2 Sequencer Uptime Feeds for more details on this.

As a result, users may be able to use the protocol while oracle feeds are stale. This could cause many problems, but as a simple example:

A user has an account with 100 tokens, valued at 1 ETH each, and no borrows
The Arbitrum sequencer goes down temporarily
While it's down, the price of the token falls to 0.5 ETH each
which will rewards calculation in Liquidation pool

https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPool.sol#L207

https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPool.sol#L218

Impact

If the Arbitrum sequencer goes down, the protocol will allow users to continue to operate at the previous (stale) rates.

Tools Used

Manual

Recommendations

Add some check to LiquidationPool.sol to make sure that sequencer is up