fix: sherlock-audit/2023-10-notional-judging#2 (#76)

notional-finance · Dec 4, 2023 · 6637abd · 6637abd
1 parent 85fc57a
commit 6637abd
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 0 deletions.
diff --git a/contracts/global/Deployments.sol b/contracts/global/Deployments.sol
@@ -13,6 +13,7 @@ import {ICurveRegistry} from "../../interfaces/curve/ICurveRegistry.sol";
 import {ICurveMetaRegistry} from "../../interfaces/curve/ICurveMetaRegistry.sol";
 import {ICurveRouterV2} from "../../interfaces/curve/ICurveRouterV2.sol";
 import {ITradingModule} from "../../interfaces/trading/ITradingModule.sol";
+import {AggregatorV2V3Interface} from "../../interfaces/chainlink/AggregatorV2V3Interface.sol";
 
 /// @title Hardcoded Deployment Addresses for Arbitrum
 library Deployments {
@@ -37,6 +38,9 @@ library Deployments {
     address internal constant CURVE_V1_HANDLER = address(0);
     address internal constant CURVE_V2_HANDLER = address(0);
     ITradingModule internal constant TRADING_MODULE = ITradingModule(0xBf6B9c5608D520469d8c4BD1E24F850497AF0Bb8);
+
+    // Chainlink L2 Sequencer Uptime: https://docs.chain.link/data-feeds/l2-sequencer-feeds/
+    AggregatorV2V3Interface internal constant SEQUENCER_UPTIME_ORACLE = AggregatorV2V3Interface(0xFdB631F5EE196F0ed6FAa767959853A9F217697D);
 }
 
 /// @title Hardcoded Deployment Addresses for Mainnet

diff --git a/contracts/trading/TradingModule.sol b/contracts/trading/TradingModule.sol
@@ -25,6 +25,9 @@ contract TradingModule is Initializable, UUPSUpgradeable, ITradingModule {
     // Used to get the proxy address inside delegate call contexts
     ITradingModule internal immutable PROXY;
 
+    // Grace period after a sequencer downtime has occurred
+    uint256 internal constant SEQUENCER_UPTIME_GRACE_PERIOD = 1 hours;
+
     error SellTokenEqualsBuyToken();
     error UnknownDEX();
     error InsufficientPermissions();
@@ -227,6 +230,21 @@ contract TradingModule is Initializable, UUPSUpgradeable, ITradingModule {
         revert UnknownDEX();
     }
 
+    function _checkSequencer() private view {
+        // See: https://docs.chain.link/data-feeds/l2-sequencer-feeds/
+        if (address(Deployments.SEQUENCER_UPTIME_ORACLE) != address(0)) {
+            (
+                /*uint80 roundID*/,
+                int256 answer,
+                uint256 startedAt,
+                /*uint256 updatedAt*/,
+                /*uint80 answeredInRound*/
+            ) = Deployments.SEQUENCER_UPTIME_ORACLE.latestRoundData();
+            require(answer == 0, "Sequencer Down");
+            require(SEQUENCER_UPTIME_GRACE_PERIOD < block.timestamp - startedAt, "Sequencer Grace Period");
+        }
+    }
+
     /// @notice Returns the Chainlink oracle price between the baseToken and the quoteToken, the
     /// Chainlink oracles. The quote currency between the oracles must match or the conversion
     /// in this method does not work. Most Chainlink oracles are baseToken/USD pairs.
@@ -240,6 +258,7 @@ contract TradingModule is Initializable, UUPSUpgradeable, ITradingModule {
         override
         returns (int256 answer, int256 decimals)
     {
+        _checkSequencer();
         PriceOracle memory baseOracle = priceOracles[baseToken];
         PriceOracle memory quoteOracle = priceOracles[quoteToken];