Chainlink prices used on SmartVaultV3 do not verify if the L2 Sequencer is down to avoid stale pricing data
Summary
Prices on SmartVaultV3 are not checking if the Arbitrum Sequencer is down, and the prices could be stale, with impact to the protocol stablecoin peg.
Vulnerability Details
Chainlink price feeds are used on SmartVaultV3 to check if loan is undercollateralised, if a user can mint more EUROs or remove collateral from the vault.
SmartVaultV3 depends on PriceCalculator contract to get the prices of the assets. In PriceCalculator it is never verified if the L2 Sequencer is down to avoid stale pricing data that appears fresh.
Impact
With knowledge of the stale prices, with the market prices moving in the right direction, loaners of EUROs could mint more EUROs than they should be allowed. On an event of an unavailable Arbitrum Sequencer, an attack could be made to mint massive amounts of EUROs without enough backing and make the stablecoin lose their peg.
Tools Used
Manual Review
Recommendations
L2 sequencer activity checks must be done when calling latestRoundData() in projects that are deployed on Arbitrum.
Chainlink’s official documentation provides an example implementation
Lead Judging Commences
Arbitrum-sequncer
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.