PNS - Missing checks for whether arbitrum, optimism or polygon Sequencer is active

[sherlock-admin]

PNS

medium

Missing checks for whether arbitrum, optimism or polygon Sequencer is active

Summary

Missing checks for whether arbitrum, optimism or polygon (L2) Sequencer is active

Vulnerability Detail

Chainlink recommends that users using price oracles, check whether the Arbitrum sequencer is active

https://docs.chain.link/data-feeds#l2-sequencer-uptime-feeds

Impact

Wrong valuation of debt, wrongly calculated possibility of liquidation, wrong value of a possible loan. All price-dependent functions will be at risk, because with high volatility of the asset in the market, the price may be out of date.

Code Snippet

https://github.com/sherlock-audit/2023-06-dodo/blob/a8d30e611acc9762029f8756d6a5b81825faf348/new-dodo-v3/contracts/DODOV3MM/periphery/D3Oracle.sol#L48

https://github.com/sherlock-audit/2023-06-dodo/blob/a8d30e611acc9762029f8756d6a5b81825faf348/new-dodo-v3/contracts/DODOV3MM/periphery/D3Oracle.sol#L58

Tool used

Manual Review

Recommendation

Use sequencer oracle to determine whether the sequencer is offline or not.
https://docs.chain.link/data-feeds/l2-sequencer-feeds

To help your applications identify when the sequencer is unavailable, you can use a data feed that tracks the last known status of the sequencer at a given point in time. This helps you prevent mass liquidations by providing a grace period to allow customers to react to such an event.

As this requires reworking the contract specifically for individual networks, it will be best to make a variation of the D3Oracle.sol contract specifically for L2 networks, in which it will be checked whether the sequencer is "alive". Deployment of the relevant contract can be automated in the deployment script.

Duplicate of #62