The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of L2 sequencer activeness check for Chainlink pricefeeds

kaysoft

Summary

Chainlink recommends sequencer activeness check for all their L2 pricefeed like Arbitrum.

Vulnerability Details

Chainlink.AggregatorV3Interface(eurUsd).latestRoundData() is used to get prices from chainlink without checking if sequencer is down as recommended by Chainlink docs for L2 price feeds.

Here is the Chainlink docs about checking for sequencer activeness: https://docs.chain.link/data-feeds/l2-sequencer-feeds

function distributeAssets(ILiquidationPoolManager.Asset[] memory _assets, uint256 _collateralRate, uint256 _hundredPC) external payable {
consolidatePendingStakes();//@audit no check for updatedAt
(,int256 priceEurUsd,,,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
uint256 stakeTotal = getStakeTotal();//@audit no check for sequencer
uint256 burnEuros;
uint256 nativePurchased;
for (uint256 j = 0; j < holders.length; j++) {
Position memory _position = positions[holders[j]];
uint256 _positionStake = stake(_position);
if (_positionStake > 0) {
for (uint256 i = 0; i < _assets.length; i++) {
ILiquidationPoolManager.Asset memory asset = _assets[i];
if (asset.amount > 0) {
(,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();

Impact

Using of stale price when sequencer is down leading to loss of funds.

Tools Used

Manual Review

Recommendations

It is recommended to check if sequencer active for L2 price feed. Here is an example code from Chainlink docs: https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Arbitrum-sequncer

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

Arbitrum-sequncer

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.