0xkazim - No check for active Arbitrum Sequencer in Oracles

[sherlock-admin]

0xkazim

medium

No check for active Arbitrum Sequencer in Oracles

Summary

Chainlink recommends that all Optimistic L2 oracles consult the Sequencer Uptime Feed to ensure that the sequencer is live before trusting the data returned by the oracle. this check is not used in the chainLink oracle implmentation.

Vulnerability Detail

If the Arbitrum Sequencer goes down, oracle data will not be kept up to date, and thus could become stale. However, users are able to continue to interact with the protocol, You can review Chainlink docs on L2 Sequencer Uptime Feeds for more details on this. As a result, users may be able to use the protocol while oracle feeds are stale. This could cause many problems, simple example :

1- alice have 100 tokens that valued at 1 ETH each(we use ETH as example the protocol may interact with other tokens)

2- The Arbitrum sequencer goes down temporarily

3-While it's down, the price of the token falls to 0.5 ETH each

4-The current value of the user's account is 50 ETH, let say the protocol allow to borrow 200ETH for 100 tokens that each of it worth 0.5ETH

5- Because of the stale price, the protocol lets them borrow 400 ETH !

this is an example and one the worse case might happen(you can set JUSD as eth because the protocol work with the JUSD token to borrow)

Impact

If the Arbitrum sequencer goes down, the protocol will allow users to continue to operate at the previous (stale) rates.

Code Snippet

https://github.com/sherlock-audit/2023-04-jojo/blob/main/smart-contract-EVM/contracts/adaptor/chainlinkAdaptor.sol#L43-L56
https://github.com/sherlock-audit/2023-04-jojo/blob/main/JUSDV1/src/oracle/JOJOOracleAdaptor.sol#LL26C5-L36C2

Tool used

Manual Review

Recommendation

add isSequencerActive check in the getPrice() function and follow the chainlink docs :

function getPrice(address token) external view override returns (uint) {
    if (!isSequencerActive()) revert Errors.L2SequencerUnavailable();
    ...
}

function isSequencerActive() internal view returns (bool) {
    (, int256 answer, uint256 startedAt,,) = sequencer.latestRoundData();
    if (block.timestamp - startedAt <= GRACE_PERIOD_TIME || answer == 1)
        return false;
    return true;
}

Duplicate of #101