DeFiHardhatFoundry
250,000 USDC
View results
Submission Details
Severity: medium
Invalid

Oracle adapters doesn't check L2 Sequencer

Summary

Chainlink recommends that all Optimistic L2 oracles consult the Sequencer Uptime Feed to ensure that the sequencer is live before trusting the data returned by the oracle. This check is absent in current oracle adapters.

Beanstalk will be redeployed on L2, so this concern becomes valid. Despite the fact that the L2 network is still unknown most probably team is interested in potential issues with different L2s such as Arbitrum.

Vulnerability Details

Chainlink recommends that users using price oracles, check whether the Arbitrum sequencer is active

https://docs.chain.link/data-feeds#l2-sequencer-uptime-feeds

If the sequencer goes down, the index oracles may have stale prices, since L2-submitted transactions (i.e. by the aggregating oracles) will not be processed.

Impact

Stale prices, e.g. if USDC were to de-peg while the sequencer is offline, stale price is used.

Tools Used

Manual Review

Recommendations

Use sequencer oracle to determine whether the sequencer is offline or not, and don't allow orders to be executed while the sequencer is offline.

Updates

Lead Judging Commences

inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

L2 Sequencer check

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.