Skip to content
This repository has been archived by the owner on Nov 12, 2023. It is now read-only.

immeas - sequencer uptime is not validated in ChainlinkOracle #316

Closed
sherlock-admin opened this issue May 10, 2023 · 0 comments
Closed
Labels
Non-Reward This issue will not receive a payout

Comments

@sherlock-admin
Copy link
Contributor

sherlock-admin commented May 10, 2023

immeas

medium

sequencer uptime is not validated in ChainlinkOracle

Summary

Lack of validation if the Arbitrum sequencer is up in Chainlink oracle

Vulnerability Detail

It is best practice to verify that not only the price is up to date but also that the sequencer is up on L2 chains:
https://docs.chain.link/data-feeds/l2-sequencer-feeds

See this:
sherlock-audit/2023-04-blueberry-judging#142

Impact

Over-borrowing JUSD or unwanted liquidations can happen due to outdated prices.

Code Snippet

https://github.com/sherlock-audit/2023-04-jojo/blob/main/smart-contract-EVM/contracts/adaptor/chainlinkAdaptor.sol#L43-L55

https://github.com/sherlock-audit/2023-04-jojo/blob/main/JUSDV1/src/oracle/JOJOOracleAdaptor.sol#L26-L35

Tool used

Manual Review

Recommendation

https://docs.chain.link/data-feeds/l2-sequencer-feeds

Duplicate of #101

@github-actions github-actions bot added Medium A valid Medium severity issue Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label labels May 17, 2023
@sherlock-admin sherlock-admin added the Reward A payout will be made for this issue label May 30, 2023
@sherlock-admin sherlock-admin added Non-Reward This issue will not receive a payout and removed Medium A valid Medium severity issue Duplicate A valid issue that is a duplicate of an issue with `Has Duplicates` label Reward A payout will be made for this issue labels Jun 19, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Non-Reward This issue will not receive a payout
Projects
None yet
Development

No branches or pull requests

1 participant