Summary

Users of the platform will be accidentally DOS as long as one oracle reverts e.g. via TIMEOUT.

Vulnerability Detail

The core invariant check _revertIfHealthFactorIsBroken() is dependent on _getAccountCollateralValue() which loops through every collateral that is allowed to calculate the user’s total collateral value in USD. However, as long as a single revert occurs e.g. if one oracle hits the TIMEOUT, the entire loop will revert and _revertIfHealthFactorIsBroken() will revert.

Impact

As long as one oracle is down, users cannot redeem collateral, cannot mint dsc, cannot burn dsc and positions cannot be liquidated.

Tool used

Manual Review

Recommendation

Consider having multiple fallback oracles in the event Chainlink oracles go down. For example, AAVE maintains their own oracles to be used as fallback.