Beanstalk: The Finale

Line of code

https://github.com/Cyfrin/2024-05-beanstalk-the-finale/blob/df2dd129a878d16d4adc75049179ac0029d9a96b/protocol/contracts/libraries/Oracle/LibChainlinkOracle.sol#L17

Summary

There is no check if the sequencer is online

Vulnerability Details

It is best practice to check that the sequencer is online before doing any calls to an oracle. If no such check is performed this can allow malicious users to have access to stale prices during the sequener downtime and can lead to a loss of funds for the protocol.

Chainlink sequencer feeds can be implemented to ensure the sequencer is online
https://docs.chain.link/data-feeds/l2-sequencer-feeds

Impact

The lack of check that the sequencer is online can lead to the use of stale prices in the protocol then the stale price can be consumed if the sequencer goes offline.

Tools Used

manual review

Recommendations

add sequencer feed to ensure the sequencer is online and we do not accept tx in an offline state.