047.md

Furry Rusty Monkey

Medium

No check if Optimism L2 sequencer is down in Chainlink feeds MasterPriceOracle.sol

Vulnerability Details

Chainlink recommends that all Optimistic L2 oracles consult the Sequencer Uptime Feed to ensure that the sequencer is live before trusting the data returned by the oracle.

If the Sequencer goes down, oracle data will not be kept up to date, and thus could become stale. However, users are able to continue to interact with the protocol directly through the L1 optimistic rollup contract. You can review Chainlink docs on [L2 Sequencer Uptime Feeds](https://docs.chain.link/docs/data-feeds/l2-sequencer-feeds/) for more details on this.

Impact

If the sequencer goes down, the protocol will allow users to continue to operate at the previous (stale) prices. This will break all the core functionality in the protocol.

This protocol uses _Price everywhere and it sub call to MasterPriceOracle.sol#latestRoundData(). As a result, users may be able to use the protocol while Oracle feeds are stale.

Code Snippet

https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/oracles/MasterPriceOracle.sol#L80

Tool Used

Solodit

Recommendation

It is recommended to follow the code example of Chainlink [here](https://docs.chain.link/data-feeds/l2-sequencer-feeds#example-code) or just add this check:

function isSequencerActive() internal view returns (bool) {
    (, int256 answer, uint256 startedAt,,) = sequencer.latestRoundData();
    if (block.timestamp - startedAt <= GRACE_PERIOD_TIME || answer == 1)
        return false;
    return true;
}