Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

sequencerUptimeFeed does not exist on Avalanche chain.

pkqs90

Summary

sequencerUptimeFeed does not exist on Avalanche chain.

Vulnerability Details

According to contest readme, Gamma will also be deployed on Avalanche. The current code hardcodes the sequencerUptimeFeed to an Arbitrum sequencer uptime feed, which will always fail on Avalanche.

This will cause all keeper functions to fail, because _validatePrice() is always called for run() and runNextAction() functions. This will brick the entire protocol.

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/main/contracts/KeeperProxy.sol#L48

function initialize() external initializer {
__Ownable2Step_init();
@> sequencerUptimeFeed = AggregatorV2V3Interface(0xFdB631F5EE196F0ed6FAa767959853A9F217697D);
}
​
function run(
address perpVault,
bool isOpen,
bool isLong,
MarketPrices memory prices,
bytes[] memory _swapData
) external onlyKeeper {
@> _validatePrice(perpVault, prices);
IPerpetualVault(perpVault).run(isOpen, isLong, prices, _swapData);
}
​
function runNextAction(address perpVault, MarketPrices memory prices, bytes[] memory _swapData) external onlyKeeper {
@> _validatePrice(perpVault, prices);
IPerpetualVault(perpVault).runNextAction(prices, _swapData);
}
​
function _validatePrice(address perpVault, MarketPrices memory prices) internal view {
// L2 Sequencer check
(
/*uint80 roundID*/,
int256 answer,
uint256 startedAt,
/*uint256 updatedAt*/,
/*uint80 answeredInRound*/
@> ) = AggregatorV2V3Interface(sequencerUptimeFeed).latestRoundData();
bool isSequencerUp = answer == 0;
require(isSequencerUp, "sequencer is down");
// Make sure the grace period has passed after the sequencer is back up.
uint256 timeSinceUp = block.timestamp - startedAt;
require(timeSinceUp > GRACE_PERIOD_TIME, "Grace period is not over");
​
address market = IPerpetualVault(perpVault).market();
IVaultReader reader = IPerpetualVault(perpVault).vaultReader();
MarketProps memory marketData = reader.getMarket(market);
_check(marketData.indexToken, prices.indexTokenPrice.min);
_check(marketData.indexToken, prices.indexTokenPrice.max);
_check(marketData.longToken, prices.indexTokenPrice.min);
_check(marketData.longToken, prices.indexTokenPrice.max);
_check(marketData.shortToken, prices.shortTokenPrice.min);
_check(marketData.shortToken, prices.shortTokenPrice.max);
}

Impact

Entire protocol is bricked on Avalanche.

Tools Used

N/A

Recommendations

Make sequencerUptimeFeed a settable parameter, and set it to address(0) on Avalanche.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_Avalanche_has_no_sequencer

Likelihood: High, run and runNextAction will revert. Impact: Low, any deposit will be retrieve thanks to cancelFlow.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.