QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Stale prices may appear as fresh on Chainlink Oracle data for L2 chains due to lack of checks on sequencer’s down time

heavenz52

The requirement as per readme is that the protocol has to work on the following chains in addition to the Ethereum Mainnet

  • OP Mainnet

  • Arbitrum

  • Base

When using Chainlink with L2 chains like Arbitrum, smart contracts must check whether the L2 Sequencer is down to avoid stale pricing data that appears fresh - Chainlink’s official documentation provides an example implementation.

More examples: [1, 2, 3, 4, 5]

Reference Article: https://medium.com/cyfrin/chainlink-oracle-defi-attacks-93b6cb6541bf

Code

In the file ChainlinkOracle::_getData we see that there are no checks for sequencer (nor are there checks in the places where this function is used in UpdatedWeightRunner, etc)

function _getData() internal view override returns (int216, uint40) {
(, /*uint80 roundID*/ int data, , /*uint startedAt*/ uint timestamp, ) = /*uint80 answeredInRound*/
priceFeed.latestRoundData();
require(data > 0, "INVLDDATA");
data = data * int(10 ** normalizationFactor);
return (int216(data), uint40(timestamp)); // Overflow of data is extremely improbable and uint40 is large enough for timestamps for a very long time
}
​
​

Mitigation

function _getData() internal view override returns (int216, uint40) {
+ if (block.chainid is L2 AND sequencer_is_down) {
+ revert SequencerIsDown();
+ }
(, /*uint80 roundID*/ int data, , /*uint startedAt*/ uint timestamp, ) = /*uint80 answeredInRound*/
priceFeed.latestRoundData();
.....
}
​
​
Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

invalid_sequencer_status_chainlink_and_L2

LightChaser: ## [Medium-6] Missing checks for whether the L2 Sequencer is active ## [Low-22] Chainlink sequencer status is not checked

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.