jprod15 - Lacks check to ensure the arbitrum sequencer is down

[sherlock-admin]

jprod15

medium

Lacks check to ensure the arbitrum sequencer is down

Summary

the functions getPrice() and getOriginalPrice() are vulnerable to the Arbitrum sequencer being down. The reason for this is that the functions do not check whether the sequencer is online before retrieving the price feed. If the sequencer is down, the functions will return outdated or stale price data, which could lead to errors in the smart contract

Vulnerability Detail

function getPrice(address token) public view override returns (uint256) {
    require(priceSources[token].isWhitelisted, "INVALID_TOKEN");
    AggregatorV3Interface priceFeed = AggregatorV3Interface(priceSources[token].oracle);
    (uint80 roundID, int256 price,, uint256 updatedAt, uint80 answeredInRound) = priceFeed.latestRoundData();
    require(price > 0, "Chainlink: Incorrect Price");
    require(block.timestamp - updatedAt < priceSources[token].heartBeat, "Chainlink: Stale Price");
    require(answeredInRound >= roundID, "Chainlink: Stale Price");
    return uint256(price) * 10 ** (36 - priceSources[token].priceDecimal - priceSources[token].tokenDecimal);
}

function getOriginalPrice(address token) public view override returns (uint256, uint8) {
    require(priceSources[token].isWhitelisted, "INVALID_TOKEN");
    AggregatorV3Interface priceFeed = AggregatorV3Interface(priceSources[token].oracle);
    (uint80 roundID, int256 price,, uint256 updatedAt, uint80 answeredInRound) = priceFeed.latestRoundData();
    require(price > 0, "Chainlink: Incorrect Price");
    require(block.timestamp - updatedAt < priceSources[token].heartBeat, "Chainlink: Stale Price");
    require(answeredInRound >= roundID, "Chainlink: Stale Price");
    uint8 priceDecimal = priceSources[token].priceDecimal;
    return (uint256(price), priceDecimal);
}

Impact

when sequencer is down, stale price is used for oracle

Code Snippet

https://github.com/sherlock-audit/2023-06-dodo/blob/main/new-dodo-v3/contracts/DODOV3MM/periphery/D3Oracle.sol#L48-L67

Tool used

Manual Review

Recommendation

recommend to add checks to ensure the sequencer is not down.
https://docs.chain.link/data-feeds/l2-sequencer-feeds

Duplicate of #62