The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

No check on active arbitrum sequencer could result in unfair liquidations

Cryptor

Summary

No check on active arbitrum sequencer could result in unfair liquidations

Vulnerability Details

Observe the following code

https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/SmartVaultV3.sol#L114-L123

function liquidate() external onlyVaultManager {
require(undercollateralised(), "err-not-liquidatable");
liquidated = true;
minted = 0;
liquidateNative();
ITokenManager.Token[] memory tokens = getTokenManager().getAcceptedTokens();
for (uint256 i = 0; i < tokens.length; i++) {
if (tokens[i].symbol != NATIVE) liquidateERC20(IERC20(tokens[i].addr));
}
}

The function liquidate allows the vault manager to liquidate the vault It calls the function undercollaterailised here

function undercollateralised() public view returns (bool) {
return minted > maxMintable();
}

the function undercollaterised determines whether a vault is under collaterized by checking the amount minted and the max mintable which then calls the function eurocollateral

function euroCollateral() private view returns (uint256 euros) {
ITokenManager.Token[] memory acceptedTokens = getTokenManager().getAcceptedTokens();
for (uint256 i = 0; i < acceptedTokens.length; i++) {
ITokenManager.Token memory token = acceptedTokens[i];
euros += calculator.tokenToEurAvg(token, getAssetBalance(token.symbol, token.addr));
}
}

The tokenToEurAvg is calculated using chainlink data feeds. However there is no check for an active L2 sequencer. Without it, the data feed can be inaccurate and stale. This can result in situations where a user is unfairly liquidated to due a sudden decrease in the price of eurocollateral with no opportunity for a user to shore up their positions.

Impact

Users can be unfairly liquidated when the arbitrum sequencer is offline

Tools Used

manual review

Recommendations

Add a check whether the sequencer is active and add a grace period to give vault users time to shore up their position

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Arbitrum-sequncer

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Arbitrum-sequncer

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.