Saeedalipoor01988 - No check if Arbitrum L2 sequencer is down in Chainlink feeds at smart-contract-EVM/contracts/adaptor/chainlinkAdaptor.sol

[sherlock-admin]

Saeedalipoor01988

medium

No check if Arbitrum L2 sequencer is down in Chainlink feeds at smart-contract-EVM/contracts/adaptor/chainlinkAdaptor.sol

Summary

Chainlink recommends that users using price oracles, check whether the Arbitrum Sequencer is
active.

Using Chainlink in L2 chains such as Arbitrum requires to check if the sequencer is down to avoid prices from looking like they are fresh although they are not.

This is duty of project to check that Arbitrum L2 sequencer is down or up ! this is not duty of external project to tell your project i am online or offline :)

Vulnerability Detail

The ChainlinkExpandAdaptor.getMarkPrice() function is using IChainlink(chainlink) to get the price of asset. There is no check that the sequencer is down:

    function getMarkPrice() external view returns (uint256 price) {
        int256 rawPrice;
        uint256 updatedAt;
        (, rawPrice, , updatedAt, ) = IChainlink(chainlink).latestRoundData();
        (, int256 USDCPrice,, uint256 USDCUpdatedAt,) = IChainlink(USDCSource).latestRoundData();
        require(
            block.timestamp - updatedAt <= heartbeatInterval,
            "ORACLE_HEARTBEAT_FAILED"
        );
        require(block.timestamp - USDCUpdatedAt <= heartbeatInterval, "USDC_ORACLE_HEARTBEAT_FAILED");
        uint256 tokenPrice = (SafeCast.toUint256(rawPrice) * 1e8) / SafeCast.toUint256(USDCPrice);
        return tokenPrice * 1e18 / decimalsCorrection;
    }

If the sequencer goes down, the index oracles may have stale prices, since L2-submitted transactions (i.e. by the aggregating oracles) will not be processed.

Impact

please check Vulnerability Detail.

Code Snippet

https://github.com/sherlock-audit/2023-04-jojo/blob/main/smart-contract-EVM/contracts/adaptor/chainlinkAdaptor.sol#L43

Tool used

Manual Review

Recommendation

It is recommended to follow the code example of Chainlink:
https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

Use a chainlink oracle to determine whether the sequencer is offline or not, and don't allow orders to be executed while the sequencer is offline.

Duplicate of #101