skyge - Oracle doesn't check if Arbitrum Sequencer is active

[sherlock-admin]

skyge

medium

Oracle doesn't check if Arbitrum Sequencer is active

Summary

DODO V3 is going to deployed on mainnet, arbitrum, optimism, bnb chain, polygon, so when using Chainlink in L2 chains such as Arbitrum requires to check if the sequencer is down.

The bug could be leveraged by malicious actors to take advantage of the sequencer downtime.

Vulnerability Detail

There is a lack of a check if the L2 Arbitrum sequencer is down.

function getPrice(address token) public view override returns (uint256) {
    require(priceSources[token].isWhitelisted, "INVALID_TOKEN");
    AggregatorV3Interface priceFeed = AggregatorV3Interface(priceSources[token].oracle);
    (uint80 roundID, int256 price,, uint256 updatedAt, uint80 answeredInRound) = priceFeed.latestRoundData();
    require(price > 0, "Chainlink: Incorrect Price");
    require(block.timestamp - updatedAt < priceSources[token].heartBeat, "Chainlink: Stale Price");
    require(answeredInRound >= roundID, "Chainlink: Stale Price");
    return uint256(price) * 10 ** (36 - priceSources[token].priceDecimal - priceSources[token].tokenDecimal);
}

function getOriginalPrice(address token) public view override returns (uint256, uint8) {
    require(priceSources[token].isWhitelisted, "INVALID_TOKEN");
    AggregatorV3Interface priceFeed = AggregatorV3Interface(priceSources[token].oracle);
    (uint80 roundID, int256 price,, uint256 updatedAt, uint80 answeredInRound) = priceFeed.latestRoundData();
    require(price > 0, "Chainlink: Incorrect Price");
    require(block.timestamp - updatedAt < priceSources[token].heartBeat, "Chainlink: Stale Price");
    require(answeredInRound >= roundID, "Chainlink: Stale Price");
    uint8 priceDecimal = priceSources[token].priceDecimal;
    return (uint256(price), priceDecimal);
}

Impact

could potentially be exploited by malicious actors to gain an unfair advantage.

Code Snippet

• https://github.com/sherlock-audit/2023-06-dodo/blob/main/new-dodo-v3/contracts/DODOV3MM/periphery/D3Oracle.sol#L48
• https://github.com/sherlock-audit/2023-06-dodo/blob/main/new-dodo-v3/contracts/DODOV3MM/periphery/D3Oracle.sol#L58

Links to same issue in past Sherlock contests being validated as a Medium:

• 0xdeadbeef - No check if Arbitrum L2 sequencer is down in Chainlink feeds 2023-01-sentiment-judging#16
• Avci - _validateAndGetPrice() doesn't check If Arbitrum sequencer is down in Chainlink feeds 2023-02-bond-judging#1
• ctf_sec - Missing checks for whether Arbitrum Sequencer is active 2023-04-blueberry-judging#142

Tool used

Manual Review

Recommendation

It is recommended to follow the code example of Chainlink:
https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code

Duplicate of #62