Contracts should check if L2 sequencer is down when fetching price from ChainLink
Summary
Using Chainlink in L2 chains such as Arbitrum requires to check if the sequencer is down to avoid prices from looking like they are fresh although they are not.
The bug could be leveraged by malicious actors to take advantage of the sequencer downtime.
Vulnerability Details
Similar issue can be found here. Vulnerability consists of not checking for the price freshness or being updated. This means the L2 sequencer can not be working, while the contract can still fetch prices from the oracle. This will lead to faulty prices being used in the contract functionality.
Impact
Distributing assets on Liquidation Pool will not work as expected. Users can get more or less assets than they should.
Tools Used
Manual review
Recommendations
It is recommended to follow the code example on chainlink docs.
Lead Judging Commences
Arbitrum-sequncer
Arbitrum-sequncer
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.