001.md

Silly Flaxen Goose

High

Insufficient checks to confirm the correct status of sequencerUptimeFeed in DebitaChainlink.sol

Summary

The missing check for a 0 value in sequencerUptimeFeed.startedAt will cause inaccurate sequencer status validation for the Debita platform as getThePrice() will pass incorrectly when startedAt is 0 and answer is also 0, failing to validate the sequencer status effectively.

Root Cause

In DebitaChainlink.sol:61, the lack of a startedAt != 0 check in checkSequencer() fails to confirm an updated sequencer status during invalid rounds.

Making sure startedAt isn't 0 is crucial for keeping the system secure and properly informed about the sequencer's status.

Internal pre-conditions

1. checkSequencer() to be called within getThePrice().
2. sequencerUptimeFeed to have both answer and startedAt set to 0.

External pre-conditions

1. experiencing a brief downtime with delayed updates in Chainlink's L2 uptime feed.
2. Invalid round leading to a startedAt value of 0.

Attack Path

1. The sequencer feed returns answer == 0 and startedAt == 0 due to invalid round.
2. checkSequencer() executes without startedAt check, passing verification even though sequencer status is unconfirmed.

Impact

Debita suffers an approximate security vulnerability, as the contract mistakenly assumes sequencer uptime, exposing protocol to outdated or incorrect oracle data.

FYR: Chainlink smartcontractkit/documentation#1995

PoC

A recent pull request to update the chainlink docs

Mitigation

Add a require(startedAt != 0, "Invalid sequencer status"); check in checkSequencer().

DebitaChainlink.sol

DebitaChainlink.sol


function checkSequencer() public view returns (bool) {
    (, int256 answer, uint256 startedAt, , ) = sequencerUptimeFeed.latestRoundData();

    // Check if the sequencer is up
    bool isSequencerUp = answer == 0;
    if (!isSequencerUp) {
        revert SequencerDown();
    }

+   // Ensure that startedAt is valid and non-zero
+   require(startedAt != 0, "Invalid sequencer status");

    // Calculate the time since the sequencer came back up
    uint256 timeSinceUp = block.timestamp - startedAt;
    if (timeSinceUp <= GRACE_PERIOD_TIME) {
        revert GracePeriodNotOver();
    }

    return true;
}