Avci - getAssetPrice() missed to check If Arbitrum sequencer is down

[sherlock-admin]

Avci

medium

getAssetPrice() missed to check If Arbitrum sequencer is down

Summary

The function getAssetPrice() in the chainlinkAdaptor.sol does not have a check for the status of the Arbitrum L2 sequencer in the Chainlink price feeds. This vulnerability could potentially be exploited by malicious actors to gain an unfair advantage.

Vulnerability Detail

function getAssetPrice() external view override returns (uint256) {
        /*uint80 roundID*/
        (, int256 price,, uint256 updatedAt,) = IChainLinkAggregator(chainlink).latestRoundData();
        (, int256 USDCPrice,, uint256 USDCUpdatedAt,) = IChainLinkAggregator(USDCSource).latestRoundData();

        require(block.timestamp - updatedAt <= heartbeatInterval, "ORACLE_HEARTBEAT_FAILED");
        require(block.timestamp - USDCUpdatedAt <= heartbeatInterval, "USDC_ORACLE_HEARTBEAT_FAILED");
        uint256 tokenPrice = (SafeCast.toUint256(price) * 1e8) / SafeCast.toUint256(USDCPrice);
        return tokenPrice * JOJOConstant.ONE / decimalsCorrection;
    }

Impact

If the sequencer is down, the prices provided by the Chainlink feeds may not be fresh, which can lead to incorrect pricing of the assets.

When the Sequencer is down, all L2 transactions sent from the L1 network wait in the pending queue.

Code Snippet

function getAssetPrice() external view override returns (uint256) {
        /*uint80 roundID*/
        (, int256 price,, uint256 updatedAt,) = IChainLinkAggregator(chainlink).latestRoundData();
        (, int256 USDCPrice,, uint256 USDCUpdatedAt,) = IChainLinkAggregator(USDCSource).latestRoundData();

        require(block.timestamp - updatedAt <= heartbeatInterval, "ORACLE_HEARTBEAT_FAILED");
        require(block.timestamp - USDCUpdatedAt <= heartbeatInterval, "USDC_ORACLE_HEARTBEAT_FAILED");
        uint256 tokenPrice = (SafeCast.toUint256(price) * 1e8) / SafeCast.toUint256(USDCPrice);
        return tokenPrice * JOJOConstant.ONE / decimalsCorrection;
    }

https://github.com/sherlock-audit/2023-04-jojo-0xdanial/blob/27cc159e9d66b7cd0e5556a7e2e154d957a82676/JUSDV1/src/oracle/JOJOOracleAdaptor.sol#L26-L35

https://github.com/sherlock-audit/2023-04-jojo-0xdanial/blob/27cc159e9d66b7cd0e5556a7e2e154d957a82676/smart-contract-EVM/contracts/adaptor/chainlinkAdaptor.sol#L43-L55

Tool used

Manual Review

Recommendation

chainlink provided useful documents about the safe usage of l2-sequencer-feeds
https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

Duplicate of #101