Missing chainlink oracle checks
Summary
The protocol uses chainlink contracts to check the price, but does not have the recommended checks in place to validate the returned data.
Vulnerability Details
Chainlink advises users of their contracts to have a staleness check on the received data. For L2s like Arbitrum, it is also advised to have a check on whether the sequencer is online. Both these checks are missing in the protocol, making it susceptible to using bad values in case of an oracle failure.
Impact
Bad pricing values can be used, leading to bad debt
Tools Used
Manual Review
Recommendations
Check if the timestamp of the latestRoundData is withing some required threshold. Also check if the arbitrum sequencer is running.
Lead Judging Commences
Arbitrum-sequncer
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.