tallo - Chainlink oracle makes no check to see if the Arbitrum sequencer is down

[sherlock-admin]

tallo

medium

Chainlink oracle makes no check to see if the Arbitrum sequencer is down

Summary

When working with chainlink in L2's its important to remember the centralization risk of the sequencer. If the sequencer is down, which has has suffered outages of over 10 hours in the past, then users will be served falsely fresh but incorrect prices.

Vulnerability Detail

    function getAssetPrice() external view override returns (uint256) {
        //@audit the 'price' returned by latestRoundData will return the most recent value BEFORE the sequencer went down
        (, int256 price,, uint256 updatedAt,) = IChainLinkAggregator(chainlink).latestRoundData();
        (, int256 USDCPrice,, uint256 USDCUpdatedAt,) = IChainLinkAggregator(USDCSource).latestRoundData();

        require(block.timestamp - updatedAt <= heartbeatInterval, "ORACLE_HEARTBEAT_FAILED");
        require(block.timestamp - USDCUpdatedAt <= heartbeatInterval, "USDC_ORACLE_HEARTBEAT_FAILED");
        uint256 tokenPrice = (SafeCast.toUint256(price) * 1e8) / SafeCast.toUint256(USDCPrice);
        return tokenPrice * JOJOConstant.ONE / decimalsCorrection;
    }

Impact

The price recorded by latestRoundData will be inaccurate since the true price won't be reported to the chain due to the sequence being down. This could lead to users being reported an outdated price.

Code Snippet

https://github.com/sherlock-audit/2023-04-jojo/blob/main/JUSDV1/src/oracle/JOJOOracleAdaptor.sol#L26

Tool used

Manual Review

Recommendation

Follow the chainlink docs for dealing with evm chains. The docs suggest to query the sequenceUptimeFeed to get an answer on whether the the sequencer is up or down
https://docs.chain.link/data-feeds/l2-sequencer-feeds#handling-outages-on-optimism-and-metis

Duplicate of #101