No check as to whether the arbitrum sequencer is down
Summary
It is stated that the protocol will be deployed on arbitrum, therefore, the sequencer must be checked in the _getData (https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/ChainlinkOracle.sol#L24-L33) function or the _getData function (https://github.com/Cyfrin/2024-12-quantamm/blob/main/pkg/pool-quantamm/contracts/UpdateWeightRunner.sol#L347) to ensure that stale price data isn't being used upon the arbitrum sequencer being down.
Vulnerability Details
Note from the chainlink docs page (https://docs.chain.link/data-feeds/using-data-feeds) here:
This best practise isn't followed.
Impact
Stale prices may be used within the system.
Tools Used
Manual review
Recommendations
Check for sequencer downtime.
Lead Judging Commences
invalid_sequencer_status_chainlink_and_L2
LightChaser: ## [Medium-6] Missing checks for whether the L2 Sequencer is active ## [Low-22] Chainlink sequencer status is not checked
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.