Liquidity Management

Summary

The contract relies on the L2 sequencer uptime feed to ensure the sequencer is operational. If the sequencer is down or the feed is delayed, the contract may fail to validate prices correctly.

Vulnerability Details

This vulnerability can be found in the lines of code below;

https://github.com/CodeHawks-Contests/2025-02-gamma/blob/84b9da452fc84762378481fa39b4087b10bab5e0/contracts/KeeperProxy.sol#L155-L180

Proof of Concept (PoC):

• The sequencer goes down, but the uptime feed is delayed in reporting this.

• The contract continues to validate prices based on outdated data, leading to incorrect executions.

• Example:

  (, int256 answer, uint256 startedAt, , ) = sequencerUptimeFeed.latestRoundData();
  require(answer == 0, "sequencer is down");
  require(block.timestamp - startedAt > GRACE_PERIOD_TIME, "Grace period is not over");

  If the sequencer is down but the feed is delayed, the contract may fail to detect the issue.

Impact

Sequencer downtime could lead to incorrect price validation and protocol instability

Tools Used

Deepseek

Recommendations

• Implement a fallback mechanism to pause operations if the sequencer is down.

• Use multiple sequencer uptime feeds to reduce reliance on a single source.

• Add a grace period for sequencer recovery to ensure accurate price validation.