Skip to content

L2 Sequencer Uptime Feed Not Checked

SAFE-0202 Oracle / Price Checked automatically by the scanner
1

What goes wrong

On an L2 (Arbitrum/Optimism/Base), the contract reads a Chainlink price without first checking the sequencer-uptime feed. During a sequencer outage the price feed goes stale while the L2 later replays transactions, letting users act on an outdated price.

2

The vulnerable pattern

proof of concept — how it is exploited
// sequencer goes down; price freezes at 2000.
// on recovery, queued tx borrows at 2000 while true price is 1500
// -> instant bad debt.
3

How to fix it

the pattern that is safe
(, int256 up,, uint256 since,) = sequencerUptimeFeed.latestRoundData();
require(up == 0 && block.timestamp - since > GRACE_PERIOD, "sequencer down");
Check the L2 sequencer-uptime feed before trusting the price.
4

Where this has happened

Largest recorded losses in the same failure class — related, not the same bug:

Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0202 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs