Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Hardcoded sequencer uptime feed will fail on Avalanche

wellbyt3

Summary

The KeeperProxy contract hardcodes the Chainlink sequencer uptime feed address for Arbitrum, but Avalanche lacks a sequencer uptime feed, breaking core protocol functionality on Avalanche.

Vulnerability Details

According to the README, contracts should be compatible with Arbitrum and Avalanche.

In KeeperProxy.sol, the Arbitrum sequencer uptime feed address is hardcoded in the intialize function:

function initialize() external initializer {
__Ownable2Step_init();
@> sequencerUptimeFeed = AggregatorV2V3Interface(0xFdB631F5EE196F0ed6FAa767959853A9F217697D);
}

The problem is that there's no sequencer uptime feed on Avalanche, so any calls from keepers to KeeperProxy.sol will revert.

Users would be able to deposit into an Avalanche perpetual vault, but the position would never be able to be opened, breaking core functionality of the protocol.

Impact

Breaks core protocol functionality.

Tools Used

Manual review.

Recommendations

If the chain is Avalanche, skip the sequencer uptime check.

Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding_Avalanche_has_no_sequencer

Likelihood: High, run and runNextAction will revert. Impact: Low, any deposit will be retrieve thanks to cancelFlow.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!