J4de - JOJOOracleAdaptor.sol#getAssetPrice does not check sequencerUptimeFeed

[sherlock-admin]

J4de

medium

JOJOOracleAdaptor.sol#getAssetPrice does not check sequencerUptimeFeed

Summary

JOJOOracleAdaptor.sol#getAssetPrice does not check sequencerUptimeFeed

Vulnerability Detail

File: oracle/JOJOOracleAdaptor.sol
 26     function getAssetPrice() external view override returns (uint256) {
 27         /*uint80 roundID*/
 28         (, int256 price,, uint256 updatedAt,) = IChainLinkAggregator(chainlink).latestRoundData();
 29         (, int256 USDCPrice,, uint256 USDCUpdatedAt,) = IChainLinkAggregator(USDCSource).latestRoundData()    ;
 30
 31         require(block.timestamp - updatedAt <= heartbeatInterval, "ORACLE_HEARTBEAT_FAILED");
 32         require(block.timestamp - USDCUpdatedAt <= heartbeatInterval, "USDC_ORACLE_HEARTBEAT_FAILED");
 33         uint256 tokenPrice = (SafeCast.toUint256(price) * 1e8) / SafeCast.toUint256(USDCPrice);
 34         return tokenPrice * JOJOConstant.ONE / decimalsCorrection;
 35     }

Using the chainlink's latestRoundData function on L2 needs to check sequencerUptimeFeed first.

Refer to the chainlink example: https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

Same problem in chainlinkAdaptor.sol contract.

Impact

May result in inaccurate prices

Code Snippet

https://github.com/JOJOexchange/JUSDV1/blob/011e10d36257a404c8c1d7d2b8c9f01a2b7a1969/src/oracle/JOJOOracleAdaptor.sol#L26-L35

Tool used

Manual Review

Recommendation

It is recommended to check sequencerUptimeFeed

    function getAssetPrice() external view override returns (uint256) {
+       (, int256 answer, uint256 startedAt, , ) = sequencerUptimeFeed.latestRoundData();
+ 			require(answer == 0);
+
        /*uint80 roundID*/
        (, int256 price,, uint256 updatedAt,) = IChainLinkAggregator(chainlink).latestRoundData();
        (, int256 USDCPrice,, uint256 USDCUpdatedAt,) = IChainLinkAggregator(USDCSource).latestRoundData();

        require(block.timestamp - updatedAt <= heartbeatInterval, "ORACLE_HEARTBEAT_FAILED");
        require(block.timestamp - USDCUpdatedAt <= heartbeatInterval, "USDC_ORACLE_HEARTBEAT_FAILED");
        uint256 tokenPrice = (SafeCast.toUint256(price) * 1e8) / SafeCast.toUint256(USDCPrice);
        return tokenPrice * JOJOConstant.ONE / decimalsCorrection;
    }

Duplicate of #101