# Operator is blocked when sequencer is down on Arbitrum

Arbitrum L1->L2 address aliasing blocks onlyOperator() calls when the sequencer is down, preventing disengage/ripcord and risking instant liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Index
- Credited: hildingr
- Disclosed: 2023-05-11
- Write-up quality: 6/10
- Original: https://github.com/sherlock-audit/2023-05-Index-judging/issues/321
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-05-Index%3AM-8
- Tags: domain:web3 impact:dos impact:funds-loss kind:contest platform:sherlock sev:medium tech:evm technique:source-review vuln:access-control vuln:dos vuln:liquidation

**Target:** BaseManagerV2 onlyOperator access control on Arbitrum
**Root cause:** L1->L2 Delayed Inbox transactions have msg.sender aliased by +0x1111...1111, so onlyOperator() checks against the raw operator EOA fail when the sequencer is down and L1 messages are the only path.
**Steps:**
1. Operator EOA is set as operator in BaseManagerV2 with onlyOperator() modifier.
2. Arbitrum sequencer goes down; users/operator must submit via L1 Delayed Inbox.
3. Delayed Inbox aliases msg.sender to L1_Address + 0x1111000000000000000000000000000000001111.
4. onlyOperator() reverts since aliased address != stored operator.
5. disengage(), ripcord, methodology/exchange changes all blocked; HF can drop below 0.95.
6. On sequencer recovery, race between instant AAVE liquidation and ripcord pull with no grace period.
**How found:** Researcher reasoned about Arbitrum's L1->L2 address aliasing semantics versus other L2s (Optimism/Polygon) where EOAs are not aliased, then traced onlyOperator() modifiers to conclude operator functions are unreachable during sequencer downtime.
**Exploitation:** Not an attacker-driven exploit; a liveness/safety failure. During a prolonged sequencer outage with market volatility, the operator cannot delever or disengage, letting the Aave3LeverageStrategyExtension position fall below max LTV and be instantly liquidated on sequencer recovery before ripcord can be pulled.
**Escalation:** Chained with market volatility and AAVE's lack of grace period for HF<0.95 to convert a liveness issue into potential instant liquidation.
**Insight:** On Arbitrum, any access control keyed to a specific EOA breaks for L1-originated messages because msg.sender is aliased; check whether safety-critical admin/operator functions remain reachable via the Delayed Inbox during sequencer outages.