HexHackers - getMarkPrice() doesn't check If Arbitrum sequencer is down in chainlinkAdaptor.sol

[sherlock-admin]

HexHackers

medium

getMarkPrice() doesn't check If Arbitrum sequencer is down in chainlinkAdaptor.sol

Summary

When utilizing Chainlink in L2 chains like Arbitrum, it's important to ensure that the prices provided are not falsely perceived as fresh, even when the sequencer is down.

The sequencer being down has happened in the past - Arbitrum sequencer suffers 10 hours outage

This will lead to wrong prices and malicious actors potentially exploiting the protocol and the users.

Vulnerability Detail

The required check to make sure the sequencer is active is not present in the code

    function getMarkPrice() external view returns (uint256 price) {
        int256 rawPrice;
        uint256 updatedAt;
        (, rawPrice, , updatedAt, ) = IChainlink(chainlink).latestRoundData();
        (, int256 USDCPrice,, uint256 USDCUpdatedAt,) = IChainlink(USDCSource).latestRoundData();
        require(
            block.timestamp - updatedAt <= heartbeatInterval,
            "ORACLE_HEARTBEAT_FAILED"
        );
        require(block.timestamp - USDCUpdatedAt <= heartbeatInterval, "USDC_ORACLE_HEARTBEAT_FAILED");
        uint256 tokenPrice = (SafeCast.toUint256(rawPrice) * 1e8) / SafeCast.toUint256(USDCPrice);
        return tokenPrice * 1e18 / decimalsCorrection;
    }

Impact

This may result in an unexpected price if the sequencer is down, opening the possibility for malicious actors to exploit the protocol.

Code Snippet

https://github.com/sherlock-audit/2023-04-jojo/blob/main/smart-contract-EVM/contracts/adaptor/chainlinkAdaptor.sol#L43

Tool used

Manual Review

Recommendation

Implement a method to check if the sequencer is down. Follow the Chainlink docs for dealing with EVM chains: https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

Duplicate of #101