QuantAMM
QuantAMM
49,600 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Sequencer Uptime Feed Check in Chainlink Oracle

ace_30

Summary

The Chainlink Oracle implementation does not validate sequencer uptime feeds as recommended by the Chainlink documentation. This oversight may lead to the use of invalid or stale data during sequencer downtime or the grace period after it comes back online, causing potential operational and financial risks.

Vulnerability Details

The `_getData` function of ChainlinkOracle.sol retrieves data from `priceFeed.latestRoundData()` without checking the status of the sequencer using a sequencer uptime feed. Optimistic Rollup protocols rely on sequencers to batch transactions and maintain network stability. When the sequencer is unavailable, most users cannot access L2 services, and the system should not rely on data feeds that are potentially stale or invalid.

Impact

• Use of Stale Data: During sequencer downtime, price feed data may not reflect the actual market state.

• Financial Losses: Applications using these data feeds could execute mass liquidations or other operations based on outdated information, leading to significant financial loss for users.

Tools Used

vscode

Recommendations

function _getData() internal view override returns (int216, uint40) {
// Check sequencer status
(, int256 answer, uint256 startedAt, , ) = sequencerUptimeFeed.latestRoundData();
require(answer == 0, "Sequencer Down");
require(block.timestamp - startedAt > GRACE_PERIOD_TIME, "Grace Period Not Over");
​
// Fetch and validate price feed data
(, int data, , uint timestamp, ) = priceFeed.latestRoundData();
require(data > 0, "INVLDDATA");
data = data * int(10 ** normalizationFactor);
return (int216(data), uint40(timestamp));
}
Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

invalid_sequencer_status_chainlink_and_L2

LightChaser: ## [Medium-6] Missing checks for whether the L2 Sequencer is active ## [Low-22] Chainlink sequencer status is not checked

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!