Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Incorrect Sequencer Status Check Could Allow Trading During L2 Downtime

sparrow

Summary

The KeeperProxy contract contains a critical logic error in its sequencer status check that inverts the intended behavior. This could allow trading operations to proceed when the L2 sequencer is down, potentially leading to trades at incorrect prices or with stale market data.

Vulnerability Details

The vulnerability exists in the _validatePrice function:

function _validatePrice(address perpVault, MarketPrices memory prices) internal view {
(
/*uint80 roundID*/,
int256 answer,
uint256 startedAt,
/*uint256 updatedAt*/,
/*uint80 answeredInRound*/
) = AggregatorV2V3Interface(sequencerUptimeFeed).latestRoundData();
bool isSequencerUp = answer == 0; // VULNERABLE LINE
require(isSequencerUp, "sequencer is down");

The contract uses Chainlink's Arbitrum Sequencer Uptime Feed (0xFdB631F5EE196F0ed6FAa767959853A9F217697D) to check sequencer status. However:

  • When answer == 0, it means the sequencer is DOWN

  • When answer == 1, it means the sequencer is UP

  • The current implementation has this logic reversed

Impact

Trades will be executed when the L2 sequencer is down, leading to:

  • Execution with stale price data

  • Trades at incorrect prices

  • Potential loss of funds due to price discrepancies

  • Manipulation opportunities during sequencer downtime

    The issue affects all core trading functions:

function run(address perpVault, bool isOpen, bool isLong, MarketPrices memory prices, bytes[] memory _swapData)
function runNextAction(address perpVault, MarketPrices memory prices, bytes[] memory _swapData)

Tools Used

Manual code review

Recommendations

  • Fix the sequencer check logic:

function _validatePrice(address perpVault, MarketPrices memory prices) internal view {
(
/*uint80 roundID*/,
int256 answer,
uint256 startedAt,
/*uint256 updatedAt*/,
/*uint80 answeredInRound*/
) = AggregatorV2V3Interface(sequencerUptimeFeed).latestRoundData();
bool isSequencerUp = answer == 1; // FIXED LINE
require(isSequencerUp, "sequencer is down");
Updates

Lead Judging Commences

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.