OracleLib.sol doesn't check If Arbitrum sequencer is down in Chainlink feeds

[codehawks-bot]

OracleLib.sol doesn't check If Arbitrum sequencer is down in Chainlink feeds

Severity

Medium Risk

Relevant GitHub Links

https://github.com/Cyfrin/2023-07-foundry-defi-stablecoin/blob/main/src/libraries/OracleLib.sol#L21-L32

Summary

When utilizing Chainlink in L2 chains like Arbitrum, it's important to ensure that the prices provided are not falsely perceived as fresh, even when the sequencer is down. This vulnerability could potentially be exploited by malicious actors to gain an unfair advantage.

Vulnerability Details

The library function for getting asset's price looks like this :

    function staleCheckLatestRoundData(AggregatorV3Interface priceFeed)
        public
        view
        returns (uint80, int256, uint256, uint256, uint80)
    {
        (uint80 roundId, int256 answer, uint256 startedAt, uint256 updatedAt, uint80 answeredInRound) =
            priceFeed.latestRoundData();

        uint256 secondsSince = block.timestamp - updatedAt;
        if (secondsSince > TIMEOUT) revert OracleLib__StalePrice();

        return (roundId, answer, startedAt, updatedAt, answeredInRound);
    }

But there is no checks regarding the scenario if L2 squencer is not active . It will lead to scenario when false price may get fetched .
Similar findings

Impact

False price may get fetched which will lead malicious users to gain an advantage .

Tools Used

Manual review .

Recommendations

Here's an code example from chainlink to mitigate the issue