Submission Details
Severity:
distributeAssets() doesn't check If Arbitrum sequencer is down in Chainlink feeds
Summary
When utilizing Chainlink in L2 chains like Arbitrum, it's important to ensure that the prices provided are not falsely perceived as fresh, even when the sequencer is down. This vulnerability could potentially be exploited by malicious actors to gain an unfair advantage.
Vulnerability Detail
There is no check:
function distributeAssets(
ILiquidationPoolManager.Asset[] memory _assets,
uint256 _collateralRate,
uint256 _hundredPC
) external payable {
consolidatePendingStakes();
(, int256 priceEurUsd, , , ) = Chainlink
.AggregatorV3Interface(eurUsd)
.latestRoundData();
uint256 stakeTotal = getStakeTotal();
uint256 burnEuros;
uint256 nativePurchased;
for (uint256 j = 0; j < holders.length; j++) {
Position memory _position = positions[holders[j]];
uint256 _positionStake = stake(_position);
if (_positionStake > 0) {
for (uint256 i = 0; i < _assets.length; i++) {
ILiquidationPoolManager.Asset memory asset = _assets[i];
if (asset.amount > 0) {
(, int256 assetPriceUsd, , , ) = Chainlink
.AggregatorV3Interface(asset.token.clAddr)
.latestRoundData();
uint256 _portion = (asset.amount * _positionStake) /
stakeTotal;
uint256 costInEuros = (((_portion *
10 ** (18 - asset.token.dec) *
uint256(assetPriceUsd)) / uint256(priceEurUsd)) *
_hundredPC) / _collateralRate;
if (costInEuros > _position.EUROs) {
_portion =
(_portion * _position.EUROs) /
costInEuros;
costInEuros = _position.EUROs;
}
_position.EUROs -= costInEuros;
rewards[
abi.encodePacked(
_position.holder,
asset.token.symbol
)
] += _portion;
burnEuros += costInEuros;
if (asset.token.addr == address(0)) {
nativePurchased += _portion;
} else {
IERC20(asset.token.addr).safeTransferFrom(
manager,
address(this),
_portion
);
}
}
}
}
positions[holders[j]] = _position;
}
if (burnEuros > 0) IEUROs(EUROs).burn(address(this), burnEuros);
returnUnpurchasedNative(_assets, nativePurchased);
}
Impact
could potentially be exploited by malicious actors to gain an unfair advantage.
Tool used
Manual Review
Recommendation
code example of Chainlink:
https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
Arbitrum-sequncer
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.