Description

The KeeperProxy contract contains a critical logic error in its sequencer status validation that inverts the intended behavior, allowing trades when the sequencer is down and blocking trades when it's up.

Location

Impact

Price Manipulation Risk

When the sequencer is down:

• Trades can execute with stale/incorrect prices

• No reliable price feed updates

• Potential for significant price manipulation

Financial Loss Scenarios

• Users could have positions opened/closed at incorrect prices

• Vault could execute trades at stale prices during sequencer downtime

• Liquidations could occur based on incorrect price data

• Profit/loss calculations would be inaccurate

System-Wide Impact

• Affects all vault operations that rely on price validation

• Impacts position management across all supported assets

• Could lead to cascading failures in automated strategies

• Compromises the core risk management system

Quantifiable Impact Example

If ETH price is $2,000 and sequencer goes down:

• Stale prices could be used

• 3x leveraged position could be opened/closed at wrong price

Affected Protocol Components

The vulnerability affects:

• Position opening/closing

• Price validation for all actions

• Risk management systems

• Automated strategy execution

Proof of Concept

The Arbitrum sequencer feed returns:

• 0 when sequencer is DOWN

• 1 when sequencer is UP

Current implementation:

This means:

• When sequencer is down (answer = 0):

  • isSequencerUp becomes true

  • require check passes

  • Trades execute with stale prices

• When sequencer is up (answer = 1):

  • isSequencerUp becomes false

  • require check fails

  • Trades are blocked

Recommended Fix

Tools Used

• Manual code review

• Static analysis

This vulnerability represents a critical failure point that could lead to substantial financial losses and system-wide disruption, particularly during periods of high market volatility when the sequencer is more likely to experience downtime.