The Standard

Summary

The distributeAssets function in the LiquidationPool contract is vulnerable to incorrect asset distribution due to its failure to check the operational status of the Arbitrum Sequencer when fetching price data from Chainlink oracles.

This flaw can lead to the use of stale or outdated price information in critical financial calculations, affecting asset distributions, liquidations, and overall protocol integrity.

This is a standard requirement while using datafeed on L2
Chainlink Documentation: L2 Sequencer Uptime Feeds

Vulnerability Details

When the distributeAssets function retrieves price data using Chainlink oracles, it does not incorporate any validation mechanism to verify the operational status of the Arbitrum Sequencer. This oversight can be particularly problematic if the Arbitrum Sequencer is down. In such scenarios, Chainlink data may not update, causing the protocol to rely on stale or outdated price information.

This issue is present in the following code snippet from the distributeAssets function:

Impact

In situations where the Arbitrum Sequencer is down, relying on potentially stale or outdated price data can lead to several adverse outcomes:

Inaccurate Asset Distribution: The protocol may distribute assets based on incorrect price data, leading to unfair or erroneous allocations.

Faulty Liquidation Calculations: The function might trigger incorrect liquidations due to the use of outdated price information.

Potential for Manipulation: Attackers could exploit known Sequencer downtimes to manipulate operations, leading to financial losses for users and the protocol.

Tools Used

Manual Review

Solidity Knowledge

Chainlink Documentation: L2 Sequencer Uptime Feeds

Recommended Mitigation

To mitigate this vulnerability, the contract should incorporate checks for the Arbitrum Sequencer's status as part of its data retrieval process from Chainlink oracles. This can be achieved by integrating with Chainlink's L2 Sequencer Uptime Feeds, which offer a reliable method to track the Sequencer's operational status.

The following code example from Chainlink's documentation demonstrates how to implement such a check:

In the distributeAssets function, this check should be performed before any price data retrieval from Chainlink oracles:

By integrating this check, the distributeAssets function can avoid using potentially stale or incorrect data during Arbitrum Sequencer downtimes, thus preserving the integrity and fairness of the protocol's operations.

For detailed implementation and understanding of the Sequencer Uptime Feeds, refer to Chainlink's official documentation: L2 Sequencer Uptime Feeds.