Breeje - Missing checks for whether Arbitrum Sequencer is active

[sherlock-admin]

Breeje

medium

Missing checks for whether Arbitrum Sequencer is active

Summary

When utilizing Chainlink in L2 chains like Arbitrum, it's important to ensure that the prices provided are not falsely perceived as fresh, even when the sequencer is down. This vulnerability could potentially be exploited by malicious actors to gain an unfair advantage.

Vulnerability Detail

The function getPriceFromChainlink do not check if the sequencer is down or not.

If a sequencer becomes unavailable, it is impossible to access read/write APIs that consumers are using and applications on the L2 network will be down for most users without interacting directly through the L1 optimistic rollup contracts. The L2 has not stopped, but it would be unfair to continue providing service on your applications when only a few users can use them.

To help your applications identify when the sequencer is unavailable, protocols should use a data feed that tracks the last known status of the sequencer at a given point in time. This helps prevent mass liquidations by providing a grace period to allow customers to react to such an event.

Chainlink recommends that users using price oracles, check whether the Arbitrum sequencer is active

https://docs.chain.link/data-feeds#l2-sequencer-uptime-feeds

If the sequencer goes down, the index oracles may have stale prices, since L2-submitted transactions (i.e. by the aggregating oracles) will not be processed.

Impact

The price recorded by latestRoundData will be inaccurate since the true price won't be reported to the chain due to the sequence being down. This could lead to users being reported an outdated price.

Code Snippet

File: PriceOracle

  function getPriceFromChainlink(address base, address quote) internal view returns (uint256) {
      (, int256 price,,,) = registry.latestRoundData(base, quote);
      require(price > 0, "invalid price");

      // Extend the decimals to 1e18.
      return uint256(price) * 10 ** (18 - uint256(registry.decimals(base, quote)));
  }

Link to Code

Tool used

Manual Review

Recommendation

Use sequencer oracle to determine whether the sequencer is offline or not, and don't allow orders to be executed while the sequencer is offline.

Duplicate of #440