# Arbitrum sequencer downtime lasting before and beyond epoch expiry prevents triggering depeg

Y2K's triggerDepeg reverts while Arbitrum sequencer is down, so a depeg spanning epoch expiry can't be triggered and collateral vault ends epoch without payout.

- Payout: Contest reward
- Severity: medium
- Program: Y2K
- Credited: Dug
- Disclosed: 2023-03-06
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-03-Y2K-judging/issues/422
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-03-Y2K%3AM-11
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm tech:solidity technique:source-review vuln:business-logic vuln:oracle-manipulation

**Target:** ControllerPeggedAssetV2.triggerDepeg / getLatestPrice on Arbitrum
**Root cause:** getLatestPrice reverts with SequencerDown or GracePeriodNotOver when the Chainlink sequencer uptime feed reports downtime, so triggerDepeg cannot execute during or shortly after an outage.
**Steps:**
1. Arbitrum sequencer goes down before epoch expiry and stays down past expiry.
2. Call `ControllerPeggedAssetV2.triggerDepeg(_marketId, _epochId)`; `getLatestPrice` reads `sequencerUptimeFeed.latestRoundData()`, answer==1, reverts `SequencerDown()`.
3. After sequencer returns, `timeSinceUp <= GRACE_PERIOD_TIME` reverts `GracePeriodNotOver()`.
4. Collateral vault users call `triggerEndEpoch` to settle the expired epoch without a depeg, claiming premiums.
**How found:** Code review of triggerDepeg's dependency on getLatestPrice and the sequencer uptime feed's revert paths, combined with the epoch expiry timing logic.
**Exploitation:** Collateral vault holders wait out the sequencer outage past epoch expiry, then call triggerEndEpoch to settle without depeg, capturing premium payments that premium vault users would otherwise receive as insurance payout.
**Insight:** When a settlement function depends on an oracle that can revert (sequencer uptime, grace period), check whether the alternative settlement path (end-epoch-without-depeg) can be invoked during the oracle's unavailability window to disadvantage the other side.