QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing L2 Sequencer Uptime feeds check in `ChainlinkOracle::_getData`

4lifemen

Summary

The protocol plans to deploy on multiple L2 chains, including Optimism, Arbitrum, and Base. However, the ChainlinkOracle contract lacks a critical L2 sequencer uptime feed check. This omission could lead to an incorrect price when the L2 sequencer experiences downtime.

While the likelihood of an L2 sequencer downtime is low, the potential impact of this incorrect price is medium because it affects the weightage and thus impacts the core functionality. Therefore, this finding is submitted as an MEDIUM** **issue.

Vulnerability Details

The ChainlinkOracle contract currently fetches price data from Chainlink's latestRoundData() function but does not validate the sequencer's operational status. For L2 environments, verifying the sequencer's uptime status is crucial to ensuring the reliability of Oracle data.

Relevant code snippets:

In ChainlinkOracle::_getDate:

function _getData() internal view override returns (int216, uint40) {
(, /*uint80 roundID*/ int data, , /*uint startedAt*/ uint timestamp /*uint80 answeredInRound*/, ) = priceFeed
.latestRoundData();
require(data > 0, "INVLDDATA");
data = data * int(10 ** normalizationFactor);
return (int216(data), uint40(timestamp)); // Overflow of data is extremely improbable and uint40 is large enough for timestamps for a very long time
}

Impact

In the absence of a sequencer uptime feed check, the oracle may:

  • Return stale or incorrect data during sequencer downtime.

  • This leads to incorrect weightage calculation affecting the core functionality.

Tools Used

  • Manual review

Recommendations

Add an L2 sequencer uptime check. Chainlink L2 sequence doc.

+ import {AggregatorV2V3Interface} from "@chainlink/contracts/src/v0.8/shared/interfaces/AggregatorV2V3Interface.sol";
​
+ AggregatorV2V3Interface internal sequencerUptimeFeed;
​
+ (
+ /*uint80 roundID*/,
+ int256 answer,
+ uint256 startedAt,
+ /*uint256 updatedAt*/,
+ /*uint80 answeredInRound*/
+ ) = sequencerUptimeFeed.latestRoundData();
​
+ // Answer == 0: Sequencer is up
+ // Answer == 1: Sequencer is down
+ bool isSequencerUp = answer == 0;
+ if (!isSequencerUp) {
+ revert SequencerDown();
+ }
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

invalid_sequencer_status_chainlink_and_L2

LightChaser: ## [Medium-6] Missing checks for whether the L2 Sequencer is active ## [Low-22] Chainlink sequencer status is not checked

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!