0x52 - chainlinkAdaptor#getMarkPrice doesn't check if the sequencer is up

[sherlock-admin]

0x52

medium

chainlinkAdaptor#getMarkPrice doesn't check if the sequencer is up

Summary

If the Arbitrum sequencer were to go offline the chainlink oracle may return an invalid/stale price. It should always be checked before consuming any data from chainlink.

Vulnerability Detail

https://github.com/sherlock-audit/2023-04-jojo/blob/main/smart-contract-EVM/contracts/adaptor/chainlinkAdaptor.sol#L43-L55

function getMarkPrice() external view returns (uint256 price) {
    int256 rawPrice;
    uint256 updatedAt;
    (, rawPrice, , updatedAt, ) = IChainlink(chainlink).latestRoundData();
    (, int256 USDCPrice,, uint256 USDCUpdatedAt,) = IChainlink(USDCSource).latestRoundData();
    require(
        block.timestamp - updatedAt <= heartbeatInterval,
        "ORACLE_HEARTBEAT_FAILED"
    );
    require(block.timestamp - USDCUpdatedAt <= heartbeatInterval, "USDC_ORACLE_HEARTBEAT_FAILED");
    uint256 tokenPrice = (SafeCast.toUint256(rawPrice) * 1e8) / SafeCast.toUint256(USDCPrice);
    return tokenPrice * 1e18 / decimalsCorrection;
}

As seen above, the Chainlink oracle never checks if the Arbitrum sequencer is up, allowing to to consume stale/invalid price data.

Impact

Invalid/stale data if Arbitrum sequencer isn't online

Code Snippet

https://github.com/sherlock-audit/2023-04-jojo/blob/main/smart-contract-EVM/contracts/adaptor/chainlinkAdaptor.sol#L43-L55

Tool used

Manual Review

Recommendation

Check sequencer uptime before consuming any price data

Duplicate of #101