Summary

see details

Vulnerability Details

Not Checking For Stale Prices

Oracle data feeds can return stale pricing data for a variety of reasons. If the returned pricing data is stale, this code will execute with prices that don’t reflect the current pricing resulting in a potential loss of funds for the user and/or the protocol. Smart contracts should always check the updatedAt parameter returned from latestRoundData() and compare it to a staleness threshold:

Not Checking For Down L2 Sequencer

When using Chainlink with L2 chains like Arbitrum, smart contracts must check whether the L2 Sequencer is down to avoid stale pricing data that appears fresh - Chainlink’s official documentation provides an example implementation. Smart contract auditors should look out for missing L2 sequencer activity checks when they see price code calling latestRoundData() in projects that are to be deployed on L2s.

Impact

Tools Used

Manual Review

Recommendations

Should implement above checks